UID/GID Standards

UID/GID Standards

The Flora Family homelab uses a standardized UID/GID mapping system to ensure security, prevent ID collisions, and simplify file permission management across the container infrastructure.

🛠️ Infrastructure Core (System IDs)

These IDs are reserved for the underlying data layers and databases.

• 70:70 (Postgres): Standard ID for all Postgres and pgvector instances.
• 970:970 (Redis/Valkey): Standard ID for all Redis and Valkey caching/session instances.

🏠 Family & Admin (50,000 Block)

Reserved for human users and administrative bots.

• 50002:60002: Christopher
• 50003:60003: Erin
• 50001:60001: Media (Service account for shared media access)
• 50004:60004: Flobot (The Robot)

🤖 Automated Services (51,000 Block)

Reserved for containerized services and application logic.

🔐 Security Principles

1. Non-Root Execution: No containers (except Watchtower & beszel-agent) run as root.
2. Config Isolation: All docker-compose files in /srv are owned by root:root with 755/644 permissions.
3. Data Ownership: All volume mounts in /main/appdata are owned by their respective service account.
4. Least Privilege: env files are restricted to 600 permissions.