<p>For pod with java application there is security context:</p>
<pre><code>spec:
  securityContext:
    runAsUser: 888
    runAsGroup: 888
    fsGroup: 888
</code></pre>
<p>Deployment manifest:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: springboot-demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: springboot-demo
  template:
    metadata:
      labels:
        app: springboot-demo
    spec:
      securityContext:
        runAsUser: 888
        runAsGroup: 888
      containers:
        - name: springboot-demo
          image: k8s.192.168.20.15.nip.io:5443/springboot-demo:8.0.0
          resources:
            limits:
              memory: &quot;1024Mi&quot;
              cpu: &quot;1000m&quot;
          ports:
            - containerPort: 9000
---
apiVersion: v1
kind: Service
metadata:
  name: springboot-demo
spec:
  type: NodePort
  selector:
    app: springboot-demo
  ports:
    - port: 9000
      targetPort: 9000
</code></pre>
<p>If I enter the container and run</p>
<blockquote>
<p>jcmd GC.heap_dump</p>
</blockquote>
<p>-&gt; permission denied
<a href="https://i.stack.imgur.com/rxP05.png" rel="nofollow noreferrer">pic 1</a></p>
<p>If I enter as a root and run</p>
<blockquote>
<p>jcmd GC.heap_dump</p>
</blockquote>
<p>-&gt; unable to open socket file /proc/1/root/tmp/.java_pid1 ...<a href="https://i.stack.imgur.com/TEQJf.png" rel="nofollow noreferrer">pic2</a></p>
<p>If I delete security context and run jcmd GC.heap_dump -&gt; it works ok.</p>
<p>What could be the problem?</p>

r4sk01
<p>I think this can have something to do with linux capabilies: <a href="https://linux-audit.com/linux-capabilities-101/" rel="nofollow noreferrer">https://linux-audit.com/linux-capabilities-101/</a></p>
<p>I would check which capabilies are available to sh/bash process started by 888 user, and compare those bash/sh started by root.</p>
