<p>I've been tasked with getting our k8s deployment running as non-Root.
A 3rd party library we use needs the home directory for the user to exist and have write access.
I've tried using initContainers but any changes I make are essentially discarded, and of course I don't have permissions on the real container</p>

<p>I would like to avoid setting all this up in the Dockerfile. Is there anyway to create the user home directory for the user kubernetes container runs as?</p>

<p>Kubernetes uses a container engine to run a pod with a specific image. <em>Most</em> Pods can die at any time, therefore they must be either based on an image with the desired state or have state preserved in a different way. </p>

<p>If there is a state that you would like to preserve and using a Dockerfile / Custom Image is not an option, I suggest you either :</p>

<ol>
<li><p>Set up a volume. 
volume mount the user directory so that the files are never deleted and permissions are preserved as well.
<a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/storage/volumes/#hostpath</a></p></li>
<li><p>Run the container together with a sidecar.
Create a pod that has a sidecar container which can run commands in the same network and can share a volume mount with the main container.</p></li>
</ol>

<p>ie. perhaps you can create a shared volume, then create an image that chowns the directory as root and use this image for a sidecar container.
<a href="https://kubernetes.io/docs/tasks/access-application-cluster/communicate-containers-same-pod-shared-volume/#creating-a-pod-that-runs-two-containers" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/access-application-cluster/communicate-containers-same-pod-shared-volume/#creating-a-pod-that-runs-two-containers</a></p>

<p>However, the simplest solution could be to just modify permissions in the Dockerfile, for example by adding some lines to a Dockerfile. If you are adding lines to you your existing Dockerfile, make sure to add them before your CMD / ENTRYPOINT</p>

<p>If you are basing this image off of your already existing one, make sure to put this at the top of your Dockerfile</p>

<p><code>FROM Myoriginalimage</code></p>

<p>Dockerfile commands:</p>

<p><code>
USER root
RUN chown $USER:$USER_GROUP -R $USER_HOME_DIR
USER $USER
</code>
make sure your CMD/ENTRYPOINT comes after this if you are editing an existing Dockerfile</p>

<p>More info on Dockerfile: <a href="https://www.linode.com/docs/applications/containers/how-to-use-dockerfiles/" rel="nofollow noreferrer">https://www.linode.com/docs/applications/containers/how-to-use-dockerfiles/</a></p>

<p>After that you can push to a registry, such as dockerhub, assuming you don't have a private registry or can't have access to one for whatever reason.</p>

<ul>
<li>create an account at hub.docker.com  </li>
<li>tag your image appropriately</li>
<li><code>docker login</code> </li>
<li><code>docker push your-image</code></li>
</ul>

<p>See here for more details: 
<a href="https://docs.docker.com/docker-hub/repos/" rel="nofollow noreferrer">https://docs.docker.com/docker-hub/repos/</a></p>
