Kubernetes

Runs scaleassembly/zshot-server as a Deployment from kubernetes.yml: one replica as a non-root user with every capability dropped and a read-only root filesystem, readiness and liveness probes on /status, and a Service on port 3000. It requests 1 GiB of memory and limits the pod to 2 GiB; size it for your renders with --server-max-concurrency. The manifest is exercised against every release.

The license comes from a Secret named zshot-license, which you create. Add --from-literal=ZSHOT_SERVER_TOKEN_AUTH=YOUR-TOKEN to require a bearer token on every request.

kubectl create secret generic zshot-license --from-literal=ZSHOT_LICENSE=YOUR-KEY
kubectl apply -f https://zshot-cli.com/deploy/kubernetes.yml

Sandbox

The pod runs with no seccomp filter, which lets Chromium’s sandbox start; RuntimeDefault blocks it. A namespace that enforces the restricted Pod Security Standard refuses an unfiltered pod, so there, place zshot-seccomp.json on each node and name it in the pod’s seccompProfile as Localhost.