<p>When i am trying to mount application log volume from containers to host
getting error: Operation not permitted</p>

<pre><code>spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  initContainers:
  - name: volume-mount-permission
    image: xx.xx.xx.xx/orchestration/credit-card
    command:
    - sh
    - -c
    - chown -R 1000:1000 /opt/payara/appserver/glassfish/logs/credit-card
    - chgrp 1000 /opt/payara/appserver/glassfish/logs/credit-card
    volumeMounts:
    - name: card-corp-logs
      mountPath: /opt/payara/appserver/glassfish/logs/credit-card
      readOnly: false

  containers:
  - name: credit-card
    image: xx.xx.xx.xx/orchestration/credit-card
    imagePullPolicy: Always
    securityContext:
      privileged: true
      runAsUser: 1000
    ports:
    - name: credit-card
      containerPort: 8080
    readinessProbe:
      httpGet:
         path: /
         port: 8080
      initialDelaySeconds: 10
      periodSeconds: 5
      successThreshold: 1
    volumeMounts:
    - name: override-setting-storage
      mountPath: /p/config
    - name: credit-card-teamsite
      mountPath: /var/credit-card/teamsite/card_corp
</code></pre>

<p>Container Path - /opt/payara/appserver/glassfish/logs/credit-card to hostPath</p>

<p>Can anyone please help me out where i am doing mistake in deployment yml file.</p>

Ravikant Kumar
<pre><code>  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
</code></pre>

<p>means you cannot <code>chown 1000:1000</code> because that user is not a member of <strong>group</strong> <code>1000</code></p>

<p>Likely you will want to run that <code>initContainer:</code> as <code>runAsUser: 0</code> in order to allow it to perform arbitrary <code>chown</code> operations</p>

<p>You also truncated your YAML that would have specified the <code>volumes:</code> that are being mounted by your <code>volumeMounts:</code> -- there is a chance that you are trying to mount a volume type that -- regardless of your <code>readOnly: false</code> declaration -- cannot be modified. <code>ConfigMap</code>, <code>Secret</code>, Downward API, and a bunch of others also will not respond to mutation requests, even as <code>root</code>.</p>
