fix(nfs): remove dangerous -s flag and unsupported sync option from unfs3

nfs/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.0.14 - 2026-03-31
+
+- fix: remove unfsd -s flag (security risk: grants all clients root access, not file handle stability)
+- fix: remove sync export option (not supported by unfs3, silently ignored)
+
 ## 1.0.13 - 2026-03-31
 
 - feat: add per-share sync option (default true) to fix I/O errors on large file transfers

nfs/config.json

@@ -1,6 +1,6 @@
 {
   "name": "NFS Server",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "slug": "nfs_server",
   "description": "Expose Home Assistant media folder via NFS.",
   "arch": [
@@ -27,8 +27,7 @@
         "folder": "media",
         "allowed_network": "192.168.1.0/24",
         "read_only": false,
-        "root_squash": true,
-        "sync": true
+        "root_squash": true
       }
     ]
   },
@@ -38,8 +37,7 @@
         "folder": "str",
         "allowed_network": "str",
         "read_only": "bool",
-        "root_squash": "bool",
-        "sync": "bool"
+        "root_squash": "bool"
       }
     ]
   },

nfs/run.sh

@@ -18,7 +18,6 @@ else
         NETWORK=$(jq -r ".shares[${i}].allowed_network" "${CONFIG}")
         READ_ONLY=$(jq -r ".shares[${i}].read_only" "${CONFIG}")
         ROOT_SQUASH=$(jq -r ".shares[${i}].root_squash" "${CONFIG}")
-        SYNC=$(jq -r ".shares[${i}].sync" "${CONFIG}")
         MOUNT_PATH="/${FOLDER}"
 
         if [ "${READ_ONLY}" = "true" ]; then
@@ -33,10 +32,6 @@ else
             OPTIONS="${OPTIONS},no_root_squash"
         fi
 
-        if [ "${SYNC}" = "true" ]; then
-            OPTIONS="${OPTIONS},sync"
-        fi
-
         OPTIONS="${OPTIONS},insecure"
 
         bashio::log.info "Exporting ${MOUNT_PATH} to ${NETWORK} (${OPTIONS})..."
@@ -53,4 +48,4 @@ cat /etc/exports
 
 # Start unfs3 user-space NFS server in foreground
 bashio::log.info "Starting unfs3 NFS server..."
-exec unfsd -d -s -e /etc/exports
+exec unfsd -d -e /etc/exports