How do I install the App Template skill?

Run npx skillmds@latest add ionfury/app-template in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is App Template safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with App Template?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is App Template free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published App Template?

ionfury (@ionfury) published this skill. Their other Agent Skills are listed on their SkillMD profile.

App Template by ionfury — Agent Skill

Name: App Template
Author: ionfury

App Template

Deploy applications using bjw-s/app-template Helm chart - a flexible chart for helmifying container images without dedicated charts. Use when: (1) Deploying container images that lack official Helm charts, (2) Creating HelmRelease manifests for Flux GitOps, (3) Configuring multi-container pods with sidecars, (4) Setting up persistent storage, ingress, services for custom applications, (5) Questions about app-template values structure or patterns, (6) Deploying any custom container to Kubernetes. Triggers: "deploy with app-template", "helmify this image", "create helm release for", "app-template values", "sidecar container", "multi-container pod helm", "deploy container image", "no helm chart available", "custom container deployment", "bjw-s", "app-template chart", "deploy docker image to kubernetes", "container without helm chart", "generic helm chart"

ionfury 4fa38fc 4 files · 36.3 KB Updated Sep 17, 2026

File contents

app-template Helm Chart

The bjw-s/app-template chart deploys containerized applications without requiring a dedicated Helm chart. It provides a declarative interface for common Kubernetes resources.

Chart source: oci://ghcr.io/bjw-s-labs/helm/app-template Schema: https://raw.githubusercontent.com/bjw-s-labs/helm-charts/app-template-4.6.0/charts/other/app-template/values.schema.json

Quick Start

Minimal values.yaml for a single-container deployment:

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/app-template-4.6.0/charts/other/app-template/values.schema.json
controllers:
  main:
    containers:
      main:
        image:
          repository: nginx
          tag: latest

service:
  main:
    controller: main
    ports:
      http:
        port: 80

Security Context

Namespace Security Level	Required
`restricted`	`defaultPodOptions.securityContext` with `runAsNonRoot: true` + `seccompProfile: RuntimeDefault`; every container needs `allowPrivilegeEscalation: false`, `capabilities.drop: ["ALL"]`, `readOnlyRootFilesystem: true`
`baseline`	`defaultPodOptions.securityContext` with `runAsUser`/`fsGroup` recommended
`privileged`	None required

task k8s:validate does NOT catch PodSecurity violations — only admission time reveals them. If an image runs as root, set runAsUser: 65534. If the app writes to the filesystem, use writable emptyDir mounts rather than disabling readOnlyRootFilesystem.

Resource Limits

Resource limits prevent runaway processes, not bin-packing. The homelab hardware is heavily over-provisioned — be generous with limits rather than running tight to avoid OOMKills and CrashLoopBackOff. Never set CPU limits unless the workload is genuinely CPU-abusive.

Workload Type	Memory Request	Memory Limit
Lightweight sidecar (gluetun, oauth2-proxy)	64Mi	256Mi
Web application	128-256Mi	512Mi-1Gi
Media application (qbittorrent, jellyfin)	512Mi	2-4Gi
Database (CNPG)	256Mi	1-2Gi

Flux HelmRelease Integration

For this homelab, app-template deploys via Flux ResourceSet. Add to kubernetes/platform/helm-charts.yaml:

- name: "my-app"
  namespace: "default"
  chart:
    name: "app-template"
    version: "4.6.0"
    url: "oci://ghcr.io/bjw-s-labs/helm"  # Note: OCI registry
  dependsOn: [cilium]

Values go in kubernetes/platform/charts/my-app.yaml.

References

references/values-reference.md — complete field reference with all YAML examples
references/patterns.md — real-world deployment examples (Vaultwarden, Home Assistant, etc.)

---name: app-templatedescription: Deploy applications using bjw-s/app-template Helm chart - a flexible chart for helmifying container images without dedicated charts. Use when: (1) Deploying container images that lack official Helm charts, (2) Creating HelmRelease manifests for Flux GitOps, (3) Configuring multi-container pods with sidecars, (4) Setting up persistent storage, ingress, services for custom applications, (5) Questions about app-template values structure or patterns, (6) Deploying any custom container to Kubernetes. Triggers: "deploy with app-template", "helmify this image", "create helm release for", "app-template values", "sidecar container", "multi-container pod helm", "deploy container image", "no helm chart available", "custom container deployment", "bjw-s", "app-template chart", "deploy docker image to kubernetes", "container without helm chart", "generic helm chart"---# app-template Helm ChartThe bjw-s/app-template chart deploys containerized applications without requiring a dedicated Helm chart. It provides a declarative interface for common Kubernetes resources.**Chart source**: `oci://ghcr.io/bjw-s-labs/helm/app-template`**Schema**: `https://raw.githubusercontent.com/bjw-s-labs/helm-charts/app-template-4.6.0/charts/other/app-template/values.schema.json`## Quick StartMinimal values.yaml for a single-container deployment:```yaml# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/app-template-4.6.0/charts/other/app-template/values.schema.jsoncontrollers: main: containers: main: image: repository: nginx tag: latestservice: main: controller: main ports: http: port: 80```## Security Context| Namespace Security Level | Required ||--------------------------|----------|| `restricted` | `defaultPodOptions.securityContext` with `runAsNonRoot: true` + `seccompProfile: RuntimeDefault`; every container needs `allowPrivilegeEscalation: false`, `capabilities.drop: ["ALL"]`, `readOnlyRootFilesystem: true` || `baseline` | `defaultPodOptions.securityContext` with `runAsUser`/`fsGroup` recommended || `privileged` | None required |`task k8s:validate` does NOT catch PodSecurity violations — only admission time reveals them. If an image runs as root, set `runAsUser: 65534`. If the app writes to the filesystem, use writable `emptyDir` mounts rather than disabling `readOnlyRootFilesystem`.## Resource LimitsResource limits prevent runaway processes, not bin-packing. The homelab hardware is heavily over-provisioned — **be generous with limits** rather than running tight to avoid OOMKills and CrashLoopBackOff. Never set CPU limits unless the workload is genuinely CPU-abusive.| Workload Type | Memory Request | Memory Limit ||--------------|----------------|--------------|| Lightweight sidecar (gluetun, oauth2-proxy) | 64Mi | 256Mi || Web application | 128-256Mi | 512Mi-1Gi || Media application (qbittorrent, jellyfin) | 512Mi | 2-4Gi || Database (CNPG) | 256Mi | 1-2Gi |## Flux HelmRelease IntegrationFor this homelab, app-template deploys via Flux ResourceSet. Add to `kubernetes/platform/helm-charts.yaml`:```yaml- name: "my-app" namespace: "default" chart: name: "app-template" version: "4.6.0" url: "oci://ghcr.io/bjw-s-labs/helm" # Note: OCI registry dependsOn: [cilium]```Values go in `kubernetes/platform/charts/my-app.yaml`.## References- `references/values-reference.md` — complete field reference with all YAML examples- `references/patterns.md` — real-world deployment examples (Vaultwarden, Home Assistant, etc.)

Frequently asked questions