<p>I'm new with Azure infrastructure and I'm trying to deploy Jenkins on AKS and be able to preserve all of my Jenkins data if the container stopped working and I run with a permissions issue for my newly created PVC.</p>
<p>I want to change the permissions for a specific folder and files in the PVC and the &quot;chmod&quot; command looks like running but doesn't do anything and the permissions are still set to 777 instead of my wanted permissions.</p>
<p>I have noticed that the Storage Class default permissions value for dirs and files are 777 but I need some specific files to be with other permissions.</p>
<p>Can I do this or there is any other option to do this?</p>

<blockquote>
<p>I want to change the permissions for a specific folder and files in the PVC and the &quot;chmod&quot; command looks like running but doesn't do anything and the permissions are still set to 777 instead of my wanted permissions.</p>
</blockquote>
<p>If you want to configure permissions in Kubernetes, you must use the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">security context</a>:</p>
<blockquote>
<p>A security context defines privilege and access control settings for a Pod or Container. Security context settings include, but are not limited to:</p>
<ul>
<li><p>Discretionary Access Control: Permission to access an object, like a file, is based on  <a href="https://wiki.archlinux.org/index.php/users_and_groups" rel="nofollow noreferrer">user ID (UID) and group ID (GID)</a>.</p>
</li>
<li><p><a href="https://en.wikipedia.org/wiki/Security-Enhanced_Linux" rel="nofollow noreferrer">Security Enhanced Linux (SELinux)</a>: Objects are assigned security labels.</p>
</li>
<li><p>Running as privileged or unprivileged.</p>
</li>
<li><p><a href="https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/" rel="nofollow noreferrer">Linux Capabilities</a>: Give a process some privileges, but not all the privileges of the root user.</p>
</li>
<li><p><a href="https://kubernetes.io/docs/tutorials/clusters/apparmor/" rel="nofollow noreferrer">AppArmor</a>: Use program profiles to restrict the capabilities of individual programs.</p>
</li>
<li><p><a href="https://kubernetes.io/docs/tutorials/clusters/seccomp/" rel="nofollow noreferrer">Seccomp</a>: Filter a process's system calls.</p>
</li>
<li><p>AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the  <a href="https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt" rel="nofollow noreferrer"><code>no_new_privs</code></a>  flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has  <code>CAP_SYS_ADMIN</code>.</p>
</li>
<li><p>readOnlyRootFilesystem: Mounts the container's root filesystem as read-only.</p>
</li>
</ul>
<p>The above bullets are not a complete set of security context settings -- please see  <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#securitycontext-v1-core" rel="nofollow noreferrer">SecurityContext</a>  for a comprehensive list.</p>
<p>For more information about security mechanisms in Linux, see  <a href="https://www.linux.com/learn/overview-linux-kernel-security-features" rel="nofollow noreferrer">Overview of Linux Kernel Security Features</a></p>
</blockquote>
<p>In your case, if you want to grant permissions for a specific object (e.g. a file), you can use <a href="https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#8-run-containers-as-a-non-root-user" rel="nofollow noreferrer">Discretionary Access Control</a>:</p>
<blockquote>
<p><strong>Containers that run as root frequently have far more permissions than their workload requires which, in case of compromise, could help an attacker further their attack.</strong></p>
<p>Containers still rely on the traditional Unix security model (called  <a href="https://www.linux.com/learn/overview-linux-kernel-security-features" rel="nofollow noreferrer">discretionary access control</a>  or DAC) - everything is a file, and permissions are granted to users and groups.</p>
</blockquote>
<p>You can also <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods" rel="nofollow noreferrer">configure volume permission and ownership change policy for Pods</a>.</p>
<p>See also:</p>
<ul>
<li><a href="https://medium.com/kubernetes-tutorials/defining-privileges-and-access-control-settings-for-pods-and-containers-in-kubernetes-2cef08fc62b7" rel="nofollow noreferrer">Defining Privileges and Access Control Settings for Pods and Containers in Kubernetes</a></li>
<li><a href="https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#8-run-containers-as-a-non-root-user" rel="nofollow noreferrer">11 Ways (Not) to Get Hacked</a></li>
</ul>
