<p>I want to run consul in kubernetes but I am not allowed to run it as user root.</p>

<p>Therefore I added</p>

<pre><code>RUN addgroup consul root
</code></pre>

<p>to the Dockerfile (derived <code>FROM consul:1.0.3</code>)</p>

<p>and start the deployment in kubernetes with</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    xyz.service: consul-deployment
  name: consul-deployment
spec:
  template:
    spec:
      securityContext:
        runAsUser: 100
</code></pre>

<p>Now I expect kubernetes to start consul with user <code>100</code> (who used to be the user <code>consul</code> when I started it locally in Docker and now should be member in the group <code>root</code>).</p>

<p>But now I get the following the error when the pod is started</p>

<pre><code>chown: /consul/data: Operation not permitted
</code></pre>

<p>The <code>chown</code> is executed in Consuls <a href="https://github.com/hashicorp/docker-consul/blob/389ad67978f3fb9c43ae270e31c2d7b121df46c0/0.X/docker-entrypoint.sh" rel="nofollow noreferrer"><code>docker-entrypoint.sh</code></a> and I guess it (still) fails because user <code>100</code> is not root.</p>

<p>Can anybody explain me how to start a container with a non root user when the container has an entrypoint script expecting to be executed as root?</p>

<p>I ended up in fixing Consuls <code>docker-entrypoint.sh</code> to check if the user is root before executing the chown command by adding some <code>if [ "$(id -u)" = "0" ]</code> tests.</p>

<p><a href="https://github.com/DatzAtWork/docker-consul/tree/DatzAtWork-patch-non-root" rel="nofollow noreferrer">You can find the patch on GitHub.</a></p>
