<p>My company bought a software we're trying to deploy on IBM cloud, using kubernetes and given private docker repository. Once deployed, there is always a Kubernetes error : &quot;Back-off restarting failed container&quot;. So I read logs in order to understand why the container is restarting and here is the error :</p>
<pre><code>Caused by: java.io.FileNotFoundException: /var/yseop-log/yseop-manager.log (Permission denied)
</code></pre>
<p>So I deduced that I just had to change permissions in the Kubernetes file. Since I'm using a deployment, I tried the following initContainer :</p>
<pre><code>initContainers:
    - name: permission-fix
      image: busybox
      command: ['sh', '-c']
      args: ['chmod -R 777 /var']
      volumeMounts:
        - mountPath: /var/yseop-engine
          name: yseop-data
        - mountPath: /var/yseop-data/yseop-manager
          name: yseop-data
        - mountPath: /var/yseop-log
          name: yseop-data
</code></pre>
<p>This didn't worked because I'm not allowed to execute chmod on read-only folders as non root user.</p>
<p>So I tried remounting those volumes, but that also failed, because I'm not a root user.</p>
<p>I then found out about running as User and group. In order to find out which User and group I had to write in my security context, I read the dockerfile and here is the user and group :</p>
<pre><code> USER 1001:0
</code></pre>
<p>So I tought I could just write this in my deployment file :</p>
<pre><code>  securityContext: 
      runAsUser: 1001  
      rusAsGroup: 0
</code></pre>
<p>Obvisouly, that didn't worked neither, because I'm not allowed to run as group 0</p>
<p>So I still don't know what to do in order to properly deploy this image. The image is working when doing a docker pull and exec on m computer, but it's not working on Kubernetes.</p>
<p>Here is my complete Volume file :</p>
<pre><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    ibm.io/auto-create-bucket: &quot;true&quot;
    ibm.io/auto-delete-bucket: &quot;false&quot;
    ibm.io/bucket: &quot;&quot;
    ibm.io/secret-name: &quot;cos-write-access&quot;
    ibm.io/endpoint: https://s3.eu-de.cloud-object-storage.appdomain.cloud
  name: yseop-pvc
  namespace: ns
  labels:
    app: yseop-pvc
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: ibmc
  volumeMode: Filesystem 
</code></pre>
<p>And here is my full deployment file :</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: yseop-manager
  namespace: ns
spec:
  selector:
    matchLabels:
      app: yseop-manager
  template:
    metadata:
      labels:
        app: yseop-manager
    spec:
      securityContext: 
          runAsUser: 1001  
          rusAsGroup: 0
      initContainers:
        - name: permission-fix
          image: busybox
          command: ['sh', '-c']
          args: ['chmod -R 777 /var']
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      containers:
        - name: yseop-manager
          image:IMAGE
          imagePullPolicy: IfNotPresent
          env:
            - name: SECURITY_USERS_DEFAULT_ENABLED
              value: &quot;true&quot;
          ports:
            - containerPort: 8080
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: yseop-data
          persistentVolumeClaim:
            claimName: yseop-pvc
</code></pre>
<p>Thanks for helping</p>

MarcoHiro
<p>Can you please try including supplementary group ID in the security context like</p>
<pre><code>SecurityContext:
   runAsUser: 1001  
   fsGroup: 2000
</code></pre>
<p>By Default <strong>runAsGroup is 0 which is root</strong>. Below link might give more insight about this.
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/</a></p>
<p>Working Yaml Content</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: yseop-manager
  namespace: ns
spec:
  selector:
    matchLabels:
      app: yseop-manager
  template:
    metadata:
      labels:
        app: yseop-manager
    spec:
      securityContext: 
          fsGroup: 2000 
      initContainers:
        - name: permission-fix
          image: busybox
          command: ['sh', '-c']
          args: ['chown -R root:2000 /var']
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      containers:
        - name: yseop-manager
          image:IMAGE
          imagePullPolicy: IfNotPresent
          securityContext:
             runAsUser: 1001
             runAsGroup: 2000
          env:
            - name: SECURITY_USERS_DEFAULT_ENABLED
              value: &quot;true&quot;
          ports:
            - containerPort: 8080
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: yseop-data
          persistentVolumeClaim:
            claimName: yseop-pvc
</code></pre>
