Update daily_stale.yml

Claude/triage hassio addons issues ssmjik

.coderabbit.yaml

@@ -0,0 +1,173 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+#
+# CodeRabbit configuration for alexbelgium/hassio-addons
+# Goals:
+#   1. Triage and provide first-line help on issues (bug reports, feature requests).
+#   2. Review pull requests against this repository's add-on conventions and linters.
+# Docs: https://docs.coderabbit.ai/getting-started/configure-coderabbit
+language: "en-US"
+
+# Max 250 chars. Detailed context lives in path_instructions below.
+tone_instructions: "HA add-on repo with 120+ Docker add-ons for Home Assistant Supervisor. Be concise, practical and friendly; most contributors are hobbyists. Link to add-on READMEs and the repo wiki. Follow existing conventions over generic best practices."
+
+early_access: false
+enable_free_tier: true
+
+reviews:
+  # "chill" keeps reviews helpful without nitpicking the many small upstream
+  # version-bump PRs that dominate this repo.
+  profile: "chill"
+  # Don't block merges; this repo merges frequently and relies on CI gating.
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: "@coderabbitai summary"
+  auto_title_placeholder: "@coderabbitai"
+  review_status: true
+  commit_status: true
+  poem: false
+  collapse_walkthrough: false
+  changed_files_summary: true
+  sequence_diagrams: false
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  suggested_reviewers: true
+
+  # Auto-apply labels consistent with the repo's existing scheme.
+  labeling_instructions:
+    - label: "bug"
+      instructions: >-
+        Apply when the PR fixes incorrect behavior in an add-on (broken startup,
+        crash, regression) rather than adding functionality.
+    - label: "enhancement"
+      instructions: >-
+        Apply when the PR adds a new add-on, a new option/feature, or otherwise
+        extends functionality.
+
+  # Skip generated/vendored content and large data artifacts that produce noise.
+  path_filters:
+    - "!**/*.png"
+    - "!**/*.svg"
+    - "!**/*.jpg"
+    - "!**/*.jpeg"
+    - "!**/*.csv"
+    - "!**/Stats"
+    - "!**/Stats2"
+    - "!README.md"
+    - "!.github/stargazer_countries.csv"
+    - "!**/translations/**"
+
+  # Repository-specific review guidance keyed by file path.
+  path_instructions:
+    - path: "**/config.yaml"
+      instructions: >-
+        Home Assistant add-on metadata. Verify that `version` was bumped when the
+        upstream version changes, that `image` follows
+        `ghcr.io/alexbelgium/{slug}-{arch}`, and that `arch`, `schema`, `map` and
+        `ports` are internally consistent. The `env_vars` schema key enables
+        arbitrary env-var passthrough handled at runtime by 00-global_var.sh; do
+        not flag it as insecure by default. Versions legitimately vary in format
+        (semver, X.Y.Z-N patch counter, LSIO tags, date-based, nightly).
+    - path: "**/Dockerfile"
+      instructions: >-
+        Add-on Dockerfiles follow a 6-section pattern and pull shared scripts from
+        .templates/. `ARG BUILD_FROM` + `FROM ${BUILD_FROM}` is expected. Package
+        pinning is NOT required (Hadolint DL3008/DL3018 are intentionally ignored).
+        If the file has an `ARG BUILD_UPSTREAM` line it must match the upstream
+        version in config.yaml. Do not suggest generic pinning or multi-stage
+        rewrites that conflict with the shared-template convention.
+    - path: "**/rootfs/etc/cont-init.d/**"
+      instructions: >-
+        S6-overlay init scripts that run in lexicographic order. Respect the
+        numbering convention (20- folders, 32- nginx ingress, 80- app config,
+        90- misc, 99- launch). Check that scripts use bashio where appropriate and
+        fail safely. SC2002 is intentionally disabled in shellcheck.
+    - path: "**/rootfs/etc/services.d/**"
+      instructions: >-
+        S6-overlay supervised service definitions. Verify run/finish scripts are
+        executable and long-running services do not exit prematurely.
+    - path: "**/*.sh"
+      instructions: >-
+        Shell scripts are formatted with shfmt (4-space indent) and linted with
+        shellcheck (SC2002 disabled). Prefer bashio helpers in add-on scripts.
+    - path: "**/updater.json"
+      instructions: >-
+        Upstream tracking config for the addons_updater automation. Validate the
+        `source` is a supported type (github, dockerhub, pip, gitlab, bitbucket,
+        helm_chart, ...) and that `upstream_repo`/`slug` are coherent. Do not
+        hand-edit `upstream_version`; it is auto-populated.
+    - path: "**/CHANGELOG.md"
+      instructions: >-
+        Every changed add-on must update its CHANGELOG.md (CI enforces this).
+        Confirm the new entry matches the bumped version in config.yaml.
+    - path: ".github/workflows/**"
+      instructions: >-
+        GitHub Actions CI/CD. Be careful with permissions and pinned action
+        versions. Note that `[nobuild]` in a commit message intentionally skips
+        the builder workflow.
+
+  abort_on_close: true
+
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    drafts: false
+    # Skip bot-generated upstream version bumps and explicit skip markers to
+    # save review budget; humans can still request a review with @coderabbitai.
+    ignore_title_keywords:
+      - "[nobuild]"
+      - "bump"
+      - "dependabot"
+    base_branches:
+      - "master"
+
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: false
+
+  # Enable the linters that match this repo's CI so CodeRabbit surfaces the same
+  # issues reviewers and CI would flag.
+  tools:
+    shellcheck:
+      enabled: true
+    hadolint:
+      enabled: true
+    markdownlint:
+      enabled: true
+    yamllint:
+      enabled: true
+    actionlint:
+      enabled: true
+    gitleaks:
+      enabled: true
+    checkov:
+      enabled: true
+    languagetool:
+      enabled: true
+      level: "default"
+    github-checks:
+      enabled: true
+      timeout_ms: 120000
+
+# Issue triage & first-line help. CodeRabbit replies in issues and PRs; auto_reply
+# lets it respond without an explicit @coderabbitai mention, and the knowledge
+# base lets it reuse past issues/PRs/learnings for better triage.
+chat:
+  auto_reply: true
+
+knowledge_base:
+  opt_out: false
+  learnings:
+    scope: "auto"
+  issues:
+    scope: "auto"
+  pull_requests:
+    scope: "auto"
+
+# Match generated docstrings to the repo language.
+code_generation:
+  docstrings:
+    language: "en-US"

.github/addon_submitters.json

@@ -8,6 +8,7 @@
   "manyfold": "ToledoEM",
   "navidrome": "baldarn",
   "netalertx": "jokob-sk",
+  "nginx proxy manager": "ToledoEM",
   "openproject": "baldarn",
   "resiliosync": "tyjtyj",
   "spotweb": "woutercoppens",

.github/workflows/daily_stale.yml

@@ -8,8 +8,8 @@
 name: Mark stale issues and pull requests
 
 on:
-  #schedule:
-  #- cron: '0 12 * * 0'
+  schedule:
+  - cron: '0 12 * * 0'
   workflow_dispatch:
 
 jobs:

addons_updater/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile addon_updater flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

arpspoof/apparmor.txt

@@ -9,6 +9,7 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

aurral/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile aurral flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   file,
   signal (send) set=(kill,term,int,hup,cont),

autobrr/apparmor.txt

@@ -9,6 +9,7 @@ profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

baikal/apparmor.txt

@@ -9,6 +9,7 @@ profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

battybirdnet-pi/apparmor.txt

@@ -9,6 +9,7 @@ profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

bazarr/apparmor.txt

@@ -10,6 +10,7 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

bentopdf/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile bentopdf flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

binance-trading-bot/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted)
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

birdnet-go/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_resource,
   file,

birdnet-pi/apparmor.txt

@@ -9,6 +9,7 @@ profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

birdnet-pipy/apparmor.txt

@@ -8,6 +8,7 @@ profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

bitwarden/apparmor.txt

@@ -8,6 +8,7 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

booksonic_air/apparmor.txt

@@ -9,6 +9,7 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

browser_brave/apparmor.txt

@@ -1 +0,0 @@
-../browser_chromium/apparmor.txt

browser_brave/apparmor.txt

@@ -0,0 +1,72 @@
+#include <tunables/global>
+
+profile browser_brave_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_admin,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# S6-Overlay
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme0n1 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /udev/* mrwkl,
+  /tmp/** mrkwl,
+  /dev/fuse/** mrkwl,
+  /dev/** mrkwl,
+  /sys/firmware/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

browser_chromium/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
+profile browser_chromium_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

browserless_chrome/apparmor.txt

@@ -9,6 +9,7 @@ profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

calibre/apparmor.txt

@@ -10,6 +10,7 @@ profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

calibre_web/apparmor.txt

@@ -10,6 +10,7 @@ profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

changedetection.io/apparmor.txt

@@ -8,6 +8,7 @@ profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

cleanuparr/apparmor.txt

@@ -8,6 +8,7 @@ profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

cloudcommander/apparmor.txt

@@ -9,6 +9,7 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

codex/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

collabora/apparmor.txt

@@ -8,6 +8,7 @@ profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

comixed/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile comixed_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

elasticsearch/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 8.14.3-3 (2026-06-19)
+- Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)
+- Fix AppArmor profile name (was `inadyn_addon`, colliding with several other add-ons); renamed to `elasticsearch_addon`
+
 ## 8.14.3-2 (2025-11-18)
 - 8.14.3-1 (2025-11-18)
   - Added `env_vars` option to support custom environment variables from the add-on configuration.

elasticsearch/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile elasticsearch_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

elasticsearch/config.yaml

@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: 8.14.3-1
+version: 8.14.3-3

emby/apparmor.txt

@@ -9,6 +9,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

emby_beta/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
+profile emby_beta_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

enedisgateway2mqtt/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile enedisgateway2mqtt_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

enedisgateway2mqtt_dev/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile enedisgateway2mqtt_dev_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

ente/apparmor.txt

@@ -9,6 +9,7 @@ profile ente_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

epicgamesfree/apparmor.txt

@@ -8,6 +8,7 @@ profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

filebrowser/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile filebrowser_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

filebrowser_quantum/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile filebrowser_quantum_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

fireflyiii/apparmor.txt

@@ -8,6 +8,7 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

fireflyiii_data_importer/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
+profile fireflyiii_data_importer_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

fireflyiii_fints_importer/apparmor.txt

@@ -8,6 +8,7 @@ profile fireflyiii_fints_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

flaresolverr/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile joplin flags=(attach_disconnected,mediate_deleted) {
+profile flaresolverr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

flexget/apparmor.txt

@@ -8,6 +8,7 @@ profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

free_games_claimer/apparmor.txt

@@ -8,6 +8,7 @@ profile free_games_claimer_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

gazpar2mqtt/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile gazpar2mqtt_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

gitea/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 1.26.2-3 (19-06-2026)
+- Minor bugs fixed
+
+## 1.26.2-2 (2026-06-19)
+- Expose app.ini in the addon_config folder so users can edit it directly via the HA file editor
+
+## 1.26.2-1 (2026-06-19)
+- Fix SSH authentication failing with `chroot("/var/empty"): Operation not permitted [preauth]` by allowing `capability sys_chroot` in the AppArmor profile, which sshd needs for privilege-separation (#2653)
 
 ## 1.26.2 (2026-05-22)
 - Update to latest version from go-gitea/gitea (changelog : https://github.com/go-gitea/gitea/releases)

gitea/README.md

@@ -1,4 +1,3 @@
-## ⚠ Open Request : [✨ [REQUEST] Access to Gitea app.ini (opened 2025-06-10)](https://github.com/alexbelgium/hassio-addons/issues/1907) by [@UplandJacob](https://github.com/UplandJacob)
 # Home assistant add-on: Gitea
 
 
@@ -62,6 +61,15 @@ DOMAIN: "homeassistant.local"
 ROOT_URL: "http://homeassistant.local:3000"
 ```
 
+### Direct app.ini Access
+
+The Gitea `app.ini` configuration file is exposed in the add-on's config folder (`/addon_configs/gitea/app.ini` on the host), making it directly editable via the HA file editor or Studio Code add-on.
+
+- **On first run**: complete the Gitea setup wizard, then restart the add-on. The generated `app.ini` will be copied to the addon_config folder automatically.
+- **On subsequent runs**: edit `/addon_configs/gitea/app.ini` directly for any Gitea setting not covered by the options above. The add-on options (SSL, DOMAIN, ROOT_URL, APP_NAME) are still applied on top of your file each restart.
+
+See the [Gitea configuration cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet) for all available options.
+
 ### Custom Scripts and Environment Variables
 
 This addon supports custom scripts and environment variables through the `addon_config` mapping:

gitea/apparmor.txt

@@ -8,6 +8,7 @@ profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

gitea/config.yaml

@@ -97,5 +97,5 @@ schema:
 slug: gitea
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/gitea
-version: "1.26.2"
+version: "1.26.2-3"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]"

gitea/rootfs/etc/cont-init.d/99-run.sh

@@ -2,7 +2,32 @@
 # shellcheck shell=bash
 set -e
 
-for file in /data/gitea/conf/app.ini /etc/templates/app.ini; do
+############################
+# EXPOSE APP.INI IN CONFIG #
+############################
+
+# Ensure the gitea conf directory exists
+mkdir -p /data/gitea/conf
+
+# If a real file (not a symlink) exists, move it to /config.
+# This covers both the initial migration from older installs and the post-wizard
+# case where Gitea's atomic SaveTo replaces the symlink with the completed config.
+# Always overwrite /config/app.ini so the installed settings are never discarded.
+if [ -f "/data/gitea/conf/app.ini" ] && [ ! -L "/data/gitea/conf/app.ini" ]; then
+    bashio::log.info "Moving app.ini to addon_config folder for direct access"
+    cp /data/gitea/conf/app.ini /config/app.ini
+    rm /data/gitea/conf/app.ini
+fi
+
+# Symlink /data/gitea/conf/app.ini -> /config/app.ini so the file is visible in the
+# addon_config folder (accessible via the HA file editor). When Gitea's first-run
+# wizard writes the config it lands in /config/app.ini via this symlink.
+if [ ! -L "/data/gitea/conf/app.ini" ]; then
+    ln -s /config/app.ini /data/gitea/conf/app.ini
+    bashio::log.info "app.ini is now accessible in your addon_config folder"
+fi
+
+for file in /config/app.ini /etc/templates/app.ini; do
 
     if [ ! -f "$file" ]; then
         continue

grampsweb/apparmor.txt

@@ -8,6 +8,7 @@ profile grampsweb_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

grav/apparmor.txt

@@ -8,6 +8,7 @@ profile grav_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

guacamole/apparmor.txt

@@ -8,6 +8,7 @@ profile guacamole_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

immich/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile immich_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

immich_frame/apparmor.txt

@@ -8,6 +8,7 @@ profile db21ed7f_immich_frame flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

immich_power_tools/apparmor.txt

@@ -8,6 +8,7 @@ profile db21ed7f_immich_power_tools flags=(attach_disconnected,mediate_deleted)
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

inadyn/apparmor.txt

@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

jackett/apparmor.txt

@@ -9,6 +9,7 @@ profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

jellyfin/apparmor.txt

@@ -10,6 +10,7 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

joal/apparmor.txt

@@ -8,6 +8,7 @@ profile joal_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

joplin/apparmor.txt

@@ -8,6 +8,7 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_time,
   file,
   signal,

kometa/apparmor.txt

@@ -9,6 +9,7 @@ profile kometa_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

librespeed/apparmor.txt

@@ -8,6 +8,7 @@ profile librespeed_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

lidarr/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
+profile lidarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

linkwarden/apparmor.txt

@@ -8,6 +8,7 @@ profile linkwarden_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

maintainerr/apparmor.txt

@@ -8,6 +8,7 @@ profile maintainerr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

manyfold/apparmor.txt

@@ -15,6 +15,7 @@ profile hassio-addons/manyfold flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
 
   deny /proc/kcore rwklx,
   deny /proc/sysrq-trigger rwklx,

mealie/apparmor.txt

@@ -8,6 +8,7 @@ profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

monica/apparmor.txt

@@ -8,6 +8,7 @@ profile monica_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

mylar3/apparmor.txt

@@ -9,6 +9,7 @@ profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

navidrome/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 0.62.0-2 (19-06-2026)
+- Minor bugs fixed
  
 ## 0.62.0 (2026-06-11)
 - Update to latest version from navidrome/navidrome (changelog : https://github.com/navidrome/navidrome/releases)

navidrome/Dockerfile

@@ -108,27 +108,4 @@ LABEL \
 # 6 Healthcheck #
 #################
 
-# Avoid spamming logs
-# hadolint ignore=SC2016
-RUN \
-    # Handle Apache configuration
-    if [ -d /etc/apache2/sites-available ]; then \
-        for file in /etc/apache2/sites-*/*.conf; do \
-            sed -i '/<VirtualHost/a \ \n    # Match requests with the custom User-Agent "HealthCheck" \n    SetEnvIf User-Agent "HealthCheck" dontlog \n    # Exclude matching requests from access logs \n    CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog' "$file"; \
-        done; \
-    fi && \
-    \
-    # Handle Nginx configuration
-    if [ -f /etc/nginx/nginx.conf ]; then \
-        awk '/http \{/{print; print "map $http_user_agent $dontlog {\n  default 0;\n  \"~*HealthCheck\" 1;\n}\naccess_log /var/log/nginx/access.log combined if=$dontlog;"; next}1' /etc/nginx/nginx.conf > /etc/nginx/nginx.conf.new && \
-        mv /etc/nginx/nginx.conf.new /etc/nginx/nginx.conf; \
-    fi
-
-ENV HEALTH_PORT="8080" \
-    HEALTH_URL=""
-HEALTHCHECK \
-    --interval=5s \
-    --retries=5 \
-    --start-period=30s \
-    --timeout=25s \
-    CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
+# Use upstream

navidrome/apparmor.txt

@@ -9,6 +9,7 @@ profile navidrome_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

navidrome/config.yaml

@@ -119,5 +119,5 @@ schema:
 slug: navidrome
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/navidrome
-version: "0.62.0"
+version: "0.62.0-2"
 webui: "[PROTO:ssl]://[HOST]:[PORT:4533]"

netalertx/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 26.6.3-1 (2026-06-19)
+- Suppress the misleading upstream "capabilities audit" ALERT (NET_RAW/NET_ADMIN reported as missing). Under the Home Assistant Supervisor these capabilities are granted but the upstream audit cannot read them, which alarmed users (#2454).
+
 ## 26.6.3 (2026-06-05)
 - Update to latest version from jokob-sk/NetAlertX (changelog : https://github.com/jokob-sk/NetAlertX/releases)
 

netalertx/Dockerfile

@@ -58,6 +58,18 @@ USER 0
 COPY rootfs/ /
 RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
 
+# Neutralise the upstream capabilities-audit step.
+# Under the Home Assistant Supervisor the required NET_RAW/NET_ADMIN capabilities
+# are granted, but the upstream audit cannot read them and prints a misleading
+# "🚨 ALERT: capabilities are missing" banner that users mistake for the cause of
+# unrelated issues (see issue #2454). The script is informational only, so we
+# replace its body with a no-op while keeping the file in place for the runner.
+RUN set -eux; \
+    for f in $(find / -type f -name '*capabilities*audit*.sh' 2>/dev/null); do \
+      printf '#!/usr/bin/env bash\n# Neutralised by the Home Assistant add-on: the required capabilities are\n# provided by the Supervisor but the upstream audit misreports them, which\n# alarmed users (issue #2454). This audit is informational only.\n:\n' > "$f"; \
+      chmod +x "$f"; \
+    done
+
 # Bring in jq + gosu (and their libs). NO apk in final stage.
 COPY --from=ha_tools /out/ /
 

netalertx/apparmor.txt

@@ -10,6 +10,7 @@ profile netalertx_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_raw,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

netalertx/config.yaml

@@ -42,4 +42,4 @@ slug: netalertx
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "26.6.3"
+version: "26.6.3-1"

netalertx_fa/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 26.6.3-1 (2026-06-19)
+- Suppress the misleading upstream "capabilities audit" ALERT (NET_RAW/NET_ADMIN reported as missing). Under the Home Assistant Supervisor these capabilities are granted but the upstream audit cannot read them, which alarmed users (#2454).
+
 ## 26.6.3 (2026-06-05)
 - Update to latest version from jokob-sk/NetAlertX (changelog : https://github.com/jokob-sk/NetAlertX/releases)
 

netalertx_fa/apparmor.txt

@@ -0,0 +1 @@
+../netalertx/apparmor.txt

netalertx_fa/config.yaml

@@ -43,4 +43,4 @@ slug: netalertx_fa
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "26.6.3"
+version: "26.6.3-1"

netbird-server/apparmor.txt

@@ -0,0 +1,49 @@
+#include <tunables/global>
+
+profile netbird-server_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

nextcloud/apparmor.txt

@@ -9,6 +9,7 @@ profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

nginx_webserver_proxy/CHANGELOG.md

@@ -1,13 +1,15 @@
-## 2.14.0 (10-05-2026)
+## 2.14.1 (19-06-2026)
 - Minor bugs fixed
 # Changelog
 
-## Unreleased
+## 2.14.1
+- Fix startup failure on aarch64/HAos: "/usr/bin/env: 'bash': Permission denied" (#2777)
+- Add s6-overlay/env/with-contenv exec rules to AppArmor profile
 
-- Fix Codacy style warnings: add blank lines around lists in README
+## 2.14.0 
+- Minor bugs fixed
 
 ## 2.14.0
-
 - Initial release wrapping jc21/nginx-proxy-manager:latest
 - NPM Admin UI on port 81; HTTP on port 80; HTTPS on port 443
 - Configurable static file server via NPM's default_host nginx config

nginx_webserver_proxy/Dockerfile

@@ -1,14 +1,18 @@
 ARG BUILD_FROM=jc21/nginx-proxy-manager:latest
 FROM ${BUILD_FROM}
 
-# NPM is Debian-based; install jq for options parsing and ensure bash is present.
+# NPM is Debian-based; install jq for options parsing + stub with-contenv if absent
 # hadolint ignore=DL3008
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends bash jq \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get install -y --no-install-recommends jq \
+    && rm -rf /var/lib/apt/lists/* \
+    && if ! command -v with-contenv >/dev/null 2>&1; then \
+         printf '#!/usr/bin/env bash\nexec "$@"\n' > /usr/bin/with-contenv \
+         && chmod +x /usr/bin/with-contenv; \
+       fi
 
 COPY run.sh /npm-addon-init.sh
-RUN chmod 0755 /npm-addon-init.sh
+RUN chmod +x /npm-addon-init.sh
 
 ARG BUILD_VERSION
 LABEL \

nginx_webserver_proxy/apparmor.txt

@@ -5,20 +5,47 @@ profile nginx-proxy-manager flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/nameservice>
   #include <abstractions/openssl>
 
-  # Core capabilities
+  # Blanket file access, following the official Home Assistant add-on AppArmor
+  # template. Confinement is enforced through the capability allow-list and the
+  # explicit deny rules below rather than by enumerating every path. Enumerating
+  # paths is impractical here: this add-on wraps the s6-overlay based
+  # jc21/nginx-proxy-manager image, whose boot runs useradd/groupadd, certbot,
+  # nginx and a Node.js backend across a deep exec chain (issue #2777).
+  file,
+
+  # Signals used by the s6-overlay supervision tree.
+  signal (send) set=(kill,term,int,hup,cont),
+
+  # Network
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
+  network unix stream,
+  network unix dgram,
+
+  # Capabilities required by the boot chain.
+  # - chown/fowner/fsetid/dac_override: file ownership and mode changes
+  # - setgid/setuid/setfcap: useradd/groupadd and privilege drops (s6-setuidgid)
+  # - net_bind_service: bind ports 80/443/81
+  # - sys_chroot: s6/nginx
+  # - kill: s6 service supervision
+  # - audit_write: PAM/useradd audit records
+  # - sys_resource: raise limits
+  capability audit_write,
   capability chown,
   capability dac_override,
+  capability fowner,
+  capability fsetid,
+  capability kill,
   capability net_bind_service,
   capability setfcap,
   capability setgid,
   capability setuid,
   capability sys_chroot,
-  capability kill,
-
-  # Process and memory management
   capability sys_resource,
 
-  # Deny dangerous capabilities
+  # Deny dangerous capabilities outright.
   deny capability dac_read_search,
   deny capability linux_immutable,
   deny capability mac_admin,
@@ -29,72 +56,30 @@ profile nginx-proxy-manager flags=(attach_disconnected,mediate_deleted) {
   deny capability sys_rawio,
   deny capability syslog,
 
-  # Network
-  network inet stream,
-  network inet dgram,
-  network inet6 stream,
-  network inet6 dgram,
-  network unix stream,
-  network unix dgram,
+  # S6-Overlay boot chain and the add-on entrypoint.
+  # The run.sh shebang is "#!/usr/bin/with-contenv bash", and with-contenv
+  # execs "/usr/bin/env bash"; without exec access here AppArmor denied it with
+  # "/usr/bin/env: 'bash': Permission denied" (issue #2777).
+  /init ix,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /sbin/** ix,
+  /usr/sbin/** ix,
+  /usr/local/bin/** ix,
+  /usr/local/sbin/** ix,
+  /opt/** ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /npm-addon-init.sh ix,
+  /etc/s6-overlay/** rwix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /run/{,**} rwk,
+  /dev/tty rw,
 
-  # /data - addon config (read/write)
-  /data/ r,
-  /data/** rwk,
-
-  # /share - Home Assistant storage (read/write)
-  /share/ r,
-  /share/** rwk,
-
-  # /media - Home Assistant media (read/write)
-  /media/ r,
-  /media/** rwk,
-
-  # /config - Home Assistant config (read/write)
-  /config/ r,
-  /config/** rwk,
-
-  # /addon_configs - addon instance config
-  /addon_configs/ r,
-  /addon_configs/** rwk,
-
-  # /etc/letsencrypt - SSL certs
-  /etc/letsencrypt/ r,
-  /etc/letsencrypt/** rwk,
-
-  # /proc and /sys
-  @{PROC}/ r,
-  @{PROC}/** rw,
-  @{sys}/ r,
-  @{sys}/** rw,
-
-  # Temporary files
-  /tmp/ r,
-  /tmp/** rwk,
-  /var/tmp/ r,
-  /var/tmp/** rwk,
-
-  # Basic system access
-  /bin/bash ix,
-  /bin/sh ix,
-  /bin/ls ix,
-  /bin/cat ix,
-  /bin/sed ix,
-  /usr/bin/jq ix,
-
-  # Nginx binary and libraries
-  /usr/sbin/nginx ix,
-  /usr/local/sbin/nginx ix,
-  /usr/lib/** rm,
-  /lib/** rm,
-  /usr/local/lib/** rm,
-
-  # Allow reading app-specific configs (read-only)
-  /etc/nginx/ r,
-  /etc/nginx/** r,
-  /var/log/ r,
-  /var/log/** w,
-
-  # Deny sensitive system areas
+  # Deny sensitive system areas.
   deny /root/** rwkl,
   deny /home/** rwkl,
   deny /proc/sysrq-trigger rwkl,

nginx_webserver_proxy/run.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 set -Eeuo pipefail
 

nzbget/apparmor.txt

@@ -9,6 +9,7 @@ profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

omni-tools/apparmor.txt

@@ -9,6 +9,7 @@ profile omni-tools flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal (send) set=(kill,term,int,hup,cont),
 

openproject/apparmor.txt

@@ -8,6 +8,7 @@ profile openproject_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

organizr/apparmor.txt

@@ -8,6 +8,7 @@ profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

photoprism/apparmor.txt

@@ -9,6 +9,7 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_rawio,
   file,

piwigo/apparmor.txt

@@ -9,6 +9,7 @@ profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

plex/apparmor.txt

@@ -9,6 +9,7 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

portainer/apparmor.txt

@@ -8,6 +8,7 @@ profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

portainer_agent/apparmor.txt

@@ -19,6 +19,7 @@ profile portainer_agent_addon flags=(attach_disconnected,mediate_deleted) {
   network unix dgram,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
 
 
 # S6-Overlay

postgres_15/apparmor.txt

@@ -8,6 +8,7 @@ profile postgres_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

prowlarr/apparmor.txt

@@ -9,6 +9,7 @@ profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,