<p>I'm trying to get gitlab-runner "run" on a kubernetes cluster, after following the official doc -> <a href="https://docs.gitlab.com/runner/install/kubernetes.html" rel="nofollow noreferrer">https://docs.gitlab.com/runner/install/kubernetes.html</a> (using kubernetes executor) I'm getting an error once I deploy:</p>

<blockquote>
  <p>Error: failed to start container "gitlab-runner": Error response from
  daemon: error while creating mount source path
  '/usr/share/ca-certificates/mozilla': mkdir
  /usr/share/ca-certificates/mozilla: read-only file system</p>
</blockquote>

<p>I'm using the examples in that web and can't figure out why isn't allowing to create that dir (As I understand the default user is root)</p>

<p>Here my config-map.yaml:</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab-runner
  namespace: gitlab
data:
  config.toml: |
    concurrent = 1
    [[runners]]
      name = "Kubernetes Runner"
      url = "URL"
      token = "TOKEN"
      executor = "kubernetes"
      [runners.kubernetes]
        namespace = "gitlab"
</code></pre>

<p>and this is the deployment.yaml</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: gitlab-runner
  namespace: gitlab
spec:
  replicas: 1
  selector:
    matchLabels:
      name: gitlab-runner
  template:
    metadata:
      labels:
        name: gitlab-runner
    spec:
      containers:
        - args:
            - run
          image: gitlab/gitlab-runner:alpine-v11.5.0
          imagePullPolicy: Always
          name: gitlab-runner
          volumeMounts:
            - mountPath: /etc/gitlab-runner
              name: config
            - mountPath: /etc/ssl/certs
              name: cacerts
              readOnly: true
      restartPolicy: Always
      volumes:
        - configMap:
            name: gitlab-runner
          name: config
        - hostPath:
            path: /usr/share/ca-certificates/mozilla
          name: cacerts
</code></pre>

<p>Here is the complete list of events initializing the pod:</p>

<pre><code>Events:
  Type     Reason                 Age                From                                                          Message
  ----     ------                 ----               ----                                                          -------
  Normal   Scheduled              29s                default-scheduler                                             Successfully assigned gitlab-runner-5b689c7cbc-hw6r5 to gke-my-project-dev-default-pool-0d32b263-6skk
  Normal   SuccessfulMountVolume  29s                kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  MountVolume.SetUp succeeded for volume "cacerts"
  Normal   SuccessfulMountVolume  29s                kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  MountVolume.SetUp succeeded for volume "config"
  Normal   SuccessfulMountVolume  29s                kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  MountVolume.SetUp succeeded for volume "default-token-6hr2h"
  Normal   Pulling                23s (x2 over 28s)  kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  pulling image "gitlab/gitlab-runner:alpine-v11.5.0"
  Normal   Pulled                 19s (x2 over 24s)  kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  Successfully pulled image "gitlab/gitlab-runner:alpine-v11.5.0"
  Normal   Created                19s (x2 over 24s)  kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  Created container
  Warning  Failed                 19s (x2 over 24s)  kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  Error: failed to start container "gitlab-runner": Error response from daemon: error while creating mount source path '/usr/share/ca-certificates/mozilla': mkdir /usr/share/ca-certificates/mozilla: read-only file system
  Warning  BackOff                14s                kubelet, gke-my-project-dev-default-pool-0d32b263-6skk  Back-off restarting failed container
</code></pre>

<p>Any clue will be appreciated</p>

<p>Thanks</p>

<p>From the logs, i am guessing you are using <strong>GKE</strong>. Google security mount your <code>/</code> file-system(see <a href="https://cloud.google.com/container-optimized-os/docs/concepts/security#filesystem" rel="nofollow noreferrer">here</a>). That's why you are getting error.</p>

<p>Try it by enabling <code>privileged</code> mode of the container:</p>

<pre><code>containers:
   securityContext:
     privileged: true
</code></pre>

<p>If that does not work, then change <code>/usr/share/ca-certificates/mozilla</code> to <code>/var/SOMETHING</code> (not sure, this is good solution). If there are files in <code>/usr/share/ca-certificates/mozilla</code>, then move/copy them to <code>/var/SOMETHING</code></p>
