<p>I'm new to Kubernetes and I'm trying to understand some security stuff.</p>

<p>My question is about the Group ID (= gid) of the user running the container.</p>

<p>I create a Pod using this official example: <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod" rel="noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod</a></p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: gcr.io/google-samples/node-hello:1.0
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false
</code></pre>

<p>In the documentation, they say:</p>

<blockquote>
  <p>In the configuration file, the <strong>runAsUser</strong> field specifies that for any
  Containers in the Pod, the <strong>first process runs with user ID 1000</strong>. The
  <strong>fsGroup</strong> field specifies that <strong>group ID 2000 is associated with all</strong>
  <strong>Containers in the Pod</strong>. Group ID 2000 is also associated with the
  volume mounted at /data/demo and with any files created in that
  volume.</p>
</blockquote>

<p>So, I go into the container:</p>

<pre><code>kubectl exec -it security-context-demo -- sh
</code></pre>

<p>I see that the first process (i.e. with PID 1) is running with user 1000 => OK, that's the behavior I expected.</p>

<pre><code> $ ps -f -p 1
 UID        PID  PPID  C STIME TTY          TIME CMD
 1000         1     0  0 13:06 ?        00:00:00 /bin/sh -c node server.js
</code></pre>

<p>Then, I create a file "testfile" in folder /data/demo. This file belongs to group "2000" because /data/demo has the "s" flag on group permission:</p>

<pre><code>$ ls -ld /data/demo
drwxrwsrwx 3 root 2000 39 Dec 29 13:26 /data/demo
$ echo hello &gt; /data/demo/testfile
$ ls -l /data/demo/testfile
-rw-r--r-- 1 1000 2000 6 Dec 29 13:29 /data/demo/testfile
</code></pre>

<p>Then, I create a subfolder "my-folder" and remove the "s" flag on group permission. I create a file "my-file" in this folder:</p>

<pre><code>$ mkdir /data/demo/my-folder
$ ls -ld /data/demo/my-folder
drwxr-sr-x 2 1000 2000 6 Dec 29 13:26 /data/demo/my-folder
$ chmod g-s /data/demo/my-folder
$ ls -ld /data/demo/my-folder
drwxr-xr-x 2 1000 2000 6 Dec 29 13:26 /data/demo/my-folder
$ touch /data/demo/my-folder/my-file
$ ls -l /data/demo/my-folder/my-file
-rw-r--r-- 1 1000 root 0 Dec 29 13:27 /data/demo/my-folder/my-file
</code></pre>

<p>I'm surprised that this file belongs to group "root", i.e. group with GID 0.
I expected that it should belong to group "2000" according to this sentence in the documentation:</p>

<blockquote>
  <p>The fsGroup field specifies that group ID 2000 is associated with all
  Containers in the Pod</p>
</blockquote>

<p>With the following commands, I see that user with UID "1000" in the container has primary Unix group "0", not 2000.</p>

<pre><code>$ id
uid=1000 gid=0(root) groups=0(root),2000
$ cat /proc/1/status
...
Pid:    1
...
Uid:    1000    1000    1000    1000
Gid:    0   0   0   0
...
Groups: 2000 
...
</code></pre>

<p>Does anyone have some explanations?</p>

<p>Why is not the user's GID set to the value of "fsGroup" field in the Pod's security context?</p>

<p>Why the user's GID is set to 0 = root?</p>

<p>Is it a bug in Kubernetes (I'm using v1.8.0)?</p>

<p>Did I misunderstand the documentation?</p>

<p>Thanks!</p>

Sylmarch
<p>Unfortunately, setting the primary group ID is currently not supported in Kubernetes, and will default to <code>gid=0</code>.</p>

<p>There is an open issue for implementing this: <a href="https://github.com/kubernetes/features/issues/213" rel="noreferrer">https://github.com/kubernetes/features/issues/213</a></p>
