How to change permission of mapped volume in kubernetes/Docker

Question

I just created image using Docker file and for changing user I just used:

USER myuser

We are using a directory to store data, we change that directory permission using:

chown -R myuser:myuser /data-dir

This Docker file is for etcd, where we want /data-dir use by etcd to store data. Now, we map the /data-dir to efs volume using kubernetes yml file.

With the below code:

volumeMounts:
        - name: etcdefs
          mountPath: /data-dir
      volumes:
      - name: etcdefs
        persistentVolumeClaim:
          claimName: efs-etcd

After this, I expect, that mapped directory /data-dir should have permission as myuser:myuser but it making the directory as root:root

Can any one suggest what I am doing wrong here ?

Oriole

Answer 1

This is because of docker. It mounts volume with only root permission and you can change it with chmod but only after the container is started.

You can read more about it here https://github.com/moby/moby/issues/2259 This issues is here for a long time.

What you can do in kubernetes is use fsGroup and force that volume is writable by GID specified. This is working solution and documented as well. More information here https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Here is an example deployment:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: alpine
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: alpine
    spec:
      securityContext:
        fsGroup: 1000
      containers:
        - name: alpine
          image: alpine
          volumeMounts:
              - mountPath: /var/alpine
                name: alpine
      volumes:
        - name: alpine
          awsElasticBlockStore:
            volumeID: vol-1234567890
            fsType: ext4

Pythagoras

Hey, can you give me example of how to write to make use of kubernetes with fsGroup. In my example give above – Oriole

@SaganPariyar I have modified my answer and now it has example deployment using fsGroup – Pythagoras

Hey, thanks for the answer, actually error was something else. Earlier we made docker images using root and while mapping it created directories using root, next time when I use myuser as the mapped volume already had directory created with root user so its giving the permission issue. I just delete the directory and recreated it with myuser and it works fine. – Oriole

Good to hear you solve it. One thing that comes to my mind is that creating a directory in container will make you prone to changes in how docker mounts volume, with kubernetes fsGroup option you will be. – Pythagoras

It should be noted that if you're using minikube, your PersistentVolume / PersistentVolumeClaim should use the default storage class. See: github.com/kubernetes/minikube/issues/… – Realm

How about volume mounted from configMap? – Bevbevan

What should be the volume ID "volumeID: vol-1234567890" in the case of Local - docker desktop ? – Foot

@happyyangyuan, looks like this feature doesn't support configMaps. "This field has no effect on ephemeral volume types such as secret, configMap, and emptydir." kubernetes.io/docs/tasks/configure-pod-container/… – Sulfapyridine