Unity Cloud Self-Hosted On-premises 0.12.0

Hardened UVCS container security: The `uvcs` (previously Plastic SCM) StatefulSet now runs as a non-root user (UID 1000) with a hardened security context. This disables privilege escalation, drops all Linux capabilities, and enforces the `RuntimeDefault` seccomp profile. This change lets you deploy in clusters that enforce strict Pod Security Standards or Kyverno policies that forbid `runAsUser: 0` .

• Linux

Hardened UVCS container security: Action required before you upgrade existing deployments

Plan a maintenance window. On the first `uvcs` pod restart after the upgrade, Kubernetes recursively changes ownership of the `uvcs` persistent volume ( `/jet` ) to GID 1000 through `fsGroupChangePolicy: OnRootMismatch` . For large repositories, this operation can take several minutes, during which the `uvcs` pod is unavailable.

Validate that your CSI driver applies `fsGroup` correctly.

`kubectl exec uvcs-0 -c uvcs -- id` returns `uid=1000 gid=1000` .

`kubectl exec uvcs-0 -c uvcs -- ls -ld /jet` shows group `1000` and no permission errors.

`kubectl logs uvcs-0 -c uvcs` shows the entrypoint creating symlinks under `/opt/plasticscm5/server` without errors and `plasticd` binding `:8087` .