<p>I'm running a mongodb instance as a kubernetes pod in a single node cluster (bare metal ubuntu machine). The volume is configured <code>ReadWriteOnce</code> as the mongodb pod is accessed only by pods in one node.</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: mongo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mongo
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: mongo
    spec:
      hostname: mongo
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: data
        - name: restore
          persistentVolumeClaim:
            claimName: restore
      containers:
        - name: mongo
          image: mongo:4.4.14
          args: [&quot;--auth&quot;]
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 27017
          volumeMounts:
            - mountPath: /data/db
              name: data
            - mountPath: /restore
              name: restore
</code></pre>
<p>But from time to time I cannot run commands like inserting documents to a non existing collection or running mongodump.
Then I do get the error <code>MongoServerError: 1: Operation not permitted</code>. This is caused by a <code>chown</code> problem: <code>ls -ld /data/db/</code> is returning</p>
<pre><code>drwxr-sr-x 4 nobody 4294967294 16384 Jun 28 18:19 /data/db/
</code></pre>
<p>I can fix the problem by running</p>
<pre><code>chown mongodb:mongodb /data/db
</code></pre>
<p>But after some time it changes again, so the same problem happens again and I have to rerun the <code>chown mongodb:mongodb /data/db</code></p>
<p>I tried to set</p>
<pre><code>securityContext:
    runAsUser: 1000
    fsGroup: 2000
</code></pre>
<p>But then the mongodb pod is failing:</p>
<pre><code>{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.379+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:23285,   &quot;ctx&quot;:&quot;main&quot;,&quot;msg&quot;:&quot;Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.383+00:00&quot;},&quot;s&quot;:&quot;W&quot;,  &quot;c&quot;:&quot;ASIO&quot;,     &quot;id&quot;:22601,   &quot;ctx&quot;:&quot;main&quot;,&quot;msg&quot;:&quot;No TransportLayer configured during NetworkInterface startup&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.384+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;NETWORK&quot;,  &quot;id&quot;:4648601, &quot;ctx&quot;:&quot;main&quot;,&quot;msg&quot;:&quot;Implicit TCP FastOpen unavailable. If TCP FastOpen is required, set tcpFastOpenServer, tcpFastOpenClient, and tcpFastOpenQueueSize.&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.384+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;STORAGE&quot;,  &quot;id&quot;:4615611, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;MongoDB starting&quot;,&quot;attr&quot;:{&quot;pid&quot;:1,&quot;port&quot;:27017,&quot;dbPath&quot;:&quot;/data/db&quot;,&quot;architecture&quot;:&quot;64-bit&quot;,&quot;host&quot;:&quot;mongodb&quot;}}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.384+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:23403,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Build Info&quot;,&quot;attr&quot;:{&quot;buildInfo&quot;:{&quot;version&quot;:&quot;4.4.14&quot;,&quot;gitVersion&quot;:&quot;0b0843af97c3ec9d2c0995152d96d2aad725aab7&quot;,&quot;openSSLVersion&quot;:&quot;OpenSSL 1.1.1f  31 Mar 2020&quot;,&quot;modules&quot;:[],&quot;allocator&quot;:&quot;tcmalloc&quot;,&quot;environment&quot;:{&quot;distmod&quot;:&quot;ubuntu2004&quot;,&quot;distarch&quot;:&quot;x86_64&quot;,&quot;target_arch&quot;:&quot;x86_64&quot;}}}}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.384+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:51765,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Operating System&quot;,&quot;attr&quot;:{&quot;os&quot;:{&quot;name&quot;:&quot;Ubuntu&quot;,&quot;version&quot;:&quot;20.04&quot;}}}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.384+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:21951,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Options set by command line&quot;,&quot;attr&quot;:{&quot;options&quot;:{&quot;net&quot;:{&quot;bindIp&quot;:&quot;*&quot;},&quot;security&quot;:{&quot;authorization&quot;:&quot;enabled&quot;}}}}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;E&quot;,  &quot;c&quot;:&quot;STORAGE&quot;,  &quot;id&quot;:20557,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;DBException in initAndListen, terminating&quot;,&quot;attr&quot;:{&quot;error&quot;:&quot;IllegalOperation: Attempted to create a lock file on a read-only directory: /data/db&quot;}}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;REPL&quot;,     &quot;id&quot;:4784900, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Stepping down the ReplicationCoordinator for shutdown&quot;,&quot;attr&quot;:{&quot;waitTimeMillis&quot;:10000}}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;COMMAND&quot;,  &quot;id&quot;:4784901, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the MirrorMaestro&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;SHARDING&quot;, &quot;id&quot;:4784902, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the WaitForMajorityService&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;NETWORK&quot;,  &quot;id&quot;:20562,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutdown: going to close listening sockets&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;NETWORK&quot;,  &quot;id&quot;:4784905, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the global connection pool&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;STORAGE&quot;,  &quot;id&quot;:4784906, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the FlowControlTicketholder&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;-&quot;,        &quot;id&quot;:20520,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Stopping further Flow Control ticket acquisitions.&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;NETWORK&quot;,  &quot;id&quot;:4784918, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the ReplicaSetMonitor&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;SHARDING&quot;, &quot;id&quot;:4784921, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the MigrationUtilExecutor&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:4784925, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down free monitoring&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;STORAGE&quot;,  &quot;id&quot;:4784927, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down the HealthLog&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;STORAGE&quot;,  &quot;id&quot;:4784929, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Acquiring the global lock for shutdown&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;-&quot;,        &quot;id&quot;:4784931, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Dropping the scope cache for shutdown&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;FTDC&quot;,     &quot;id&quot;:4784926, &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down full-time data capture&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:20565,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Now exiting&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-07-03T10:09:24.386+00:00&quot;},&quot;s&quot;:&quot;I&quot;,  &quot;c&quot;:&quot;CONTROL&quot;,  &quot;id&quot;:23138,   &quot;ctx&quot;:&quot;initandlisten&quot;,&quot;msg&quot;:&quot;Shutting down&quot;,&quot;attr&quot;:{&quot;exitCode&quot;:100}}
</code></pre>
<p>I also tried</p>
<pre><code>  initContainers:
    - name: mongodb-init
      image: mongo:4.4.14
      command: [&quot;sh&quot;, &quot;-c&quot;, &quot;chown 999:999 /data/db&quot;]
      volumeMounts:
        - name: data
          mountPath: /data/db
</code></pre>
<p>But after some time I again get:</p>
<pre><code>drwxr-sr-x 4 nobody 4294967294 16384 Jun 28 18:19 /data/db/
</code></pre>
<p>I do not understand what is causing this behaviour.</p>

<p>If you set <code>securityContext</code> then according to the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod" rel="nofollow noreferrer">official documentation</a>:</p>
<blockquote>
<p>the runAsUser field specifies that for any Containers in the Pod, all processes run with user ID 1000.</p>
</blockquote>
<p>there is no fear of mismatching between different processes of the container.</p>
<p>Perhaps you could give (although not recommended) root user access to the pod by setting <code>runAsUser</code> to <code>0</code>? Just to see if security context can fix the issue. It should.</p>
