<p>I am trying to create a statefulset that runs zookeper, but I want it to run as non-root (i.e. under the zookeper user).<br />
This is the image used for this:</p>
<p><a href="https://github.com/kubernetes-retired/contrib/blob/master/statefulsets/zookeeper/Dockerfile" rel="nofollow noreferrer">https://github.com/kubernetes-retired/contrib/blob/master/statefulsets/zookeeper/Dockerfile</a></p>
<p>This is how I am trying to mount the volumes (Apparently I need a init container according to <a href="https://serverfault.com/questions/906083/how-to-mount-volume-with-specific-uid-in-kubernetes-pod">this</a>):</p>
<pre><code>      initContainers:
      # Changes username for volumes
      - name: changes-username
        image: busybox
        command:
        - /bin/sh
        - -c
        - |
          chown -R 1000:1000 /var/lib/zookeeper /etc/zookeeper-conf # &lt;&lt;&lt;&lt;--- this returns
          # cannot change ownership, permission denied
          # read-only filesystem.

      containers:
      - name: zookeeper
        imagePullPolicy: IfNotPresent
        image: my-repo/k8szk:3.4.14
        command:
        - sh
        - -c
        - |
          zkGenConfig.sh # The script right here requires /var/lib/zookeper to be owned by zookeper user.
                         # Initially zookeeper user does own it as per the dockerfile above,
                         # but when mounting the volume, the directory becomes owned by root
                         # hence the script fails.
        volumeMounts:
        - name: zk-data
          mountPath: /var/lib/zookeeper
        - name: zk-log4j-config
          mountPath: /etc/zookeeper-conf
</code></pre>
<p>I also tried to add the securityContext: <code>fsGroup: 1000</code> with no change.</p>

<p>This can be configured using the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods" rel="noreferrer">security context</a>, e.g.</p>
<pre><code>securityContext:
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
</code></pre>
<p>Then you don't need the initContainer at all - Kubernetes will handle the recursive chown as part of making the volume ready.</p>
<p>One issue here is the Dockerfile linked doesn't container a <code>USER</code> statement, so Kubernetes doesn't know to start the pod as the correct user - the <code>runAsUser</code> will fix that.</p>
<p>The reason the <code>initContainer</code> hack you're trying isn't working is because you're also trying to change the ownership of the read-only config directory. ConfigMaps are mounted read-only, you can't chown them. (This used to be different, but was changed for security reasons)</p>
