<p>I'm playing with kubernetes and google container engine (GKE).</p>
<p>I deployed a container from this image <a href="https://github.com/jupyter/docker-stacks/tree/master/all-spark-notebook" rel="noreferrer">jupyter/all-spark-notebook</a></p>
<p>This is my replication controller :</p>
<pre><code>{
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;kind&quot;: &quot;ReplicationController&quot;,
  &quot;metadata&quot;: {
    &quot;name&quot;: &quot;datalab-notebook&quot;
  },
  &quot;spec&quot;: {
    &quot;replicas&quot;: 1,
    &quot;selector&quot;: {
      &quot;app&quot;: &quot;datalab-notebook&quot;
    },
    &quot;template&quot;: {
      &quot;metadata&quot;: {
        &quot;name&quot;: &quot;datalab-notebook&quot;,
        &quot;labels&quot;: {
          &quot;environment&quot;: &quot;TEST&quot;,
          &quot;app&quot;: &quot;datalab-notebook&quot;
        }
      },
      &quot;spec&quot;: {
        &quot;containers&quot;: [{
          &quot;name&quot;: &quot;datalab-notebook-container&quot;,
          &quot;image&quot;: &quot;jupyter/all-spark-notebook&quot;,
          &quot;env&quot;: [],
          &quot;ports&quot;: [{
            &quot;containerPort&quot;: 8888,
            &quot;name&quot;: &quot;datalab-port&quot;
          }],
          &quot;volumeMounts&quot;: [{
            &quot;name&quot;: &quot;datalab-notebook-persistent-storage&quot;,
            &quot;mountPath&quot;: &quot;/home/jovyan/work&quot;
          }]
        }],
        &quot;volumes&quot;: [{
          &quot;name&quot;: &quot;datalab-notebook-persistent-storage&quot;,
          &quot;gcePersistentDisk&quot;: {
            &quot;pdName&quot;: &quot;datalab-notebook-disk&quot;,
            &quot;fsType&quot;: &quot;ext4&quot;
          }
        }]
      }
    }

  }
}
</code></pre>
<p>As you can see I mounted a Google Compute Engine Persistent Disk. My issue is that the container uses a non-root user and the mounted disk is owned by root. so my container can not write to the disk.</p>
<ul>
<li><strong>Is there a way to mount GCE persistent disks and make them read/write for containers without non-root users?</strong></li>
<li><strong>Another general question : is it safe to run container with root user in Google Container Engine?</strong></li>
</ul>
<p>Thank you in advance for your inputs</p>

<p>You can use the FSGroup field of the pod's security context to make GCE PDs writable by non-root users.  </p>

<p>In this example, the gce volume will be owned by group 1234 and the container process will have 1234 in its list of supplemental groups:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  securityContext:
    fsGroup: 1234
  containers:
  - image: gcr.io/google_containers/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /test-pd
      name: test-volume
  volumes:
  - name: test-volume
    # This GCE PD must already exist.
    gcePersistentDisk:
      pdName: my-data-disk
      fsType: ext4
</code></pre>
