alright, im about to submit the PRs as promised. I am runnning all three containers as they are in the forks in prod right now. I have tested the helm chart as well, but there are still some other issues that prevent it from running, e.g. the unreslved server data PVC. If my PRs are accepted I would like to submit a series of PRs to the helm chart to get it up to speed, at least when it comes to the access model. I have a plan, but it's very hairy, because the repo has historically been using containers that used root and made a bunch of adjustments to make it work rootless when desired, a lot depends on the flag runAsNonRoot, and actually that flag does not really make sense anymore - so what I would like to do there is to get rid of it altogether and hardcode runAsNonRoot in the securitycontext of the pods instead, as that is the default of the containers anyways. Needs refactoring though. And not entirely sure yet what the best solution to the PVC is, still advocating for the "remove the PVC" option, or mount subdirs, but ultimately maybe a restructure of the containers dirs would also be nice. and about the r10k container now being GID 0 accessed, the helm chart needs a specific PR to not override the entrypoint script, possible could also think about exposing superchrony as a proper flag in the container instead of the cron script of the helm chart, either way, needs a separate PR. Happy to help here as well