<p>This is in my deployment YAML file:</p>

<pre><code>     readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 10001
</code></pre>

<p>What changes do I have to make to install python:</p>

<pre><code>kubectl exec -it carts-66bc68f95f-8wjgx -c carts -n sock-shop -- sh
/usr/src/app $ apk add python
ERROR: Unable to lock database: Permission denied
ERROR: Failed to open apk database: Permission denied
/usr/src/app $ echo hello &gt; sample.txt
sh: can't create sample.txt: Read-only file system
/usr/src/app $ 
</code></pre>

<p>First, I recommend that you start from a container image that already has Python installed.</p>
<p><strong>By default</strong>, you basically can't from the Kubernetes shell. This works as designed for security reasons with the default Pod <code>securityContext</code> setting <code>readOnlyRootFilesystem: true</code>. However, you can override this by using:</p>
<pre><code>securityContext:
          ...
          readOnlyRootFilesystem: false
          ...
</code></pre>
<p>Keep in mind that using this setting might be restricted by a <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">Pod Security Policy (PSP)</a> already setup in your cluster.</p>
<p>Also, note that Pod Security Policies <a href="https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/" rel="nofollow noreferrer">are going away</a> in Kubernetes 1.25 in favor of <a href="https://github.com/kubernetes/enhancements/issues/2579" rel="nofollow noreferrer">PodSecurity Admission</a>.</p>
<p>Alternatively, if you are running Docker a way to bypass this is to login/SSH to the machine where this Pod is running. (You might not be able to SSH to the node depending what security controls your organization has in place)</p>
<p>Find the container in question:</p>
<pre><code>$ docker ps -a | grep carts-66bc68f95f-8wjgx
</code></pre>
<p>Then exec to the container as root:</p>
<pre><code>$ docker exec -it --user=root &lt;container-name&gt; bash
# apk add python
</code></pre>
