kubernetes.yml

# zshot server on Kubernetes with Chromium's sandbox on.
#
#   1. kubectl create secret generic zshot-license --from-literal=ZSHOT_LICENSE=YOUR-KEY
#      Add --from-literal=ZSHOT_SERVER_TOKEN_AUTH=YOUR-TOKEN to require a bearer token.
#   2. kubectl apply -f kubernetes.yml
#
# The pod runs with no seccomp filter, so the sandbox starts; RuntimeDefault
# blocks it. A namespace enforcing the restricted Pod Security Standard needs
# zshot-seccomp.json on each node as a Localhost profile instead.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: zshot
  labels:
    app: zshot
spec:
  replicas: 1
  selector:
    matchLabels:
      app: zshot
  template:
    metadata:
      labels:
        app: zshot
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
      containers:
        - name: zshot
          image: scaleassembly/zshot-server:0.49.1
          ports:
            - name: http
              containerPort: 3000
          envFrom:
            - secretRef:
                name: zshot-license
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
          # Memory and concurrency are in tension: every concurrent render is a
          # browser instance, and video renders need the most. Your workload sets
          # the requirement. See https://zshot-cli.com/reference/flags/server/server-max-concurrency/
          # for sizing per slot.
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              memory: 2Gi
          readinessProbe:
            httpGet:
              path: /status
              port: http
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /status
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
      volumes:
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: zshot
spec:
  selector:
    app: zshot
  ports:
    - port: 3000
      targetPort: http