Thanks for the insight. They submitted said they're willing to help with future issues, so I guess I don't need to worry about it too much. (I can just discontinue k8s support if they don't keep their word.)

Upon further testing, this does actually work. You may set both read_only: true, and cap_drop: all and it will work as long as you have a named volume. I had it mount a database file from the host system for my test config, which is why I was getting the errors. I don't know how to make that work though i.e. when the db is bind mounted from the host system. Setting the mount :rw doesn't seem to fix it.

That's great to know. Btw, you don't actually need to specify the url path for it to work. That's just for convenience of copying the link from the UI. It'll just work as long as the server is reachable at that address.

Thanks. I had never tested this before. Seems like it throws errors. Of course, adding and deleting links don't work. But that's to be expected. But also link resolution fails since it cannot update the hit count properly. If this is a legitimate use case for you, I might work on making it work.

Like the other guy said, it's not necessary. But docker makes it much easier to deploy. There are instructions to set it up without docker as well.