How to change permission of mapped volume in kubernetes/Docker

Question

I just created image using Docker file and for changing user I just used:

USER myuser

We are using a directory to store data, we change that directory permission using:

chown -R myuser:myuser /data-dir

This Docker file is for etcd, where we want /data-dir use by etcd to store data. Now, we map the /data-dir to efs volume using kubernetes yml file.

With the below code:

volumeMounts:
        - name: etcdefs
          mountPath: /data-dir
      volumes:
      - name: etcdefs
        persistentVolumeClaim:
          claimName: efs-etcd

After this, I expect, that mapped directory /data-dir should have permission as myuser:myuser but it making the directory as root:root

Can any one suggest what I am doing wrong here ?

vascop · Accepted Answer · 2017-10-16 20:20:05Z

25

This is because of docker. It mounts volume with only root permission and you can change it with chmod but only after the container is started.

You can read more about it here https://github.com/moby/moby/issues/2259 This issues is here for a long time.

What you can do in kubernetes is use fsGroup and force that volume is writable by GID specified. This is working solution and documented as well. More information here https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Here is an example deployment:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: alpine
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: alpine
    spec:
      securityContext:
        fsGroup: 1000
      containers:
        - name: alpine
          image: alpine
          volumeMounts:
              - mountPath: /var/alpine
                name: alpine
      volumes:
        - name: alpine
          awsElasticBlockStore:
            volumeID: vol-1234567890
            fsType: ext4

edited Oct 16, 2017 at 20:20

vascop

5,2724 gold badges44 silver badges50 bronze badges

answered Oct 16, 2017 at 11:41

3h4x

9369 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Sagan Pariyar Over a year ago

Hey, can you give me example of how to write to make use of kubernetes with fsGroup. In my example give above

3h4x Over a year ago

@SaganPariyar I have modified my answer and now it has example deployment using fsGroup

Sagan Pariyar Over a year ago

Hey, thanks for the answer, actually error was something else. Earlier we made docker images using root and while mapping it created directories using root, next time when I use myuser as the mapped volume already had directory created with root user so its giving the permission issue. I just delete the directory and recreated it with myuser and it works fine.

3h4x Over a year ago

Good to hear you solve it. One thing that comes to my mind is that creating a directory in container will make you prone to changes in how docker mounts volume, with kubernetes fsGroup option you will be.

happyyangyuan Over a year ago

How about volume mounted from configMap?

|

Collectives™ on Stack Overflow

How to change permission of mapped volume in kubernetes/Docker

1 Answer 1

8 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related