<p>I have a docker image that I am trying to run using K8s. I can get it to run on my home environment but not at my workplace as we cannot run as root on the k8 cluster.</p>
<p>The docker image is a Tomcat server with a WAR file that lives here:</p>
<p><strong>/usr/local/tomcat/webapps/ROOT.war</strong></p>
<p>During start-up Tomcat tries to explode the WAR into a directory here:</p>
<p><strong>/usr/local/tomcat/webapps/ROOT</strong></p>
<p>But it can't do this because /usr/local/tomcat/webapps/ is owned by ROOT.</p>
<p>So I thought the best way to solve was to mount a volume with an emptyDir{} like so:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers: 
    ...
    name: test-container
    volumeMounts:
    - mountPath: //usr/local/tomcat/webapps/ROOT
      name: tomcat
  volumes:
  - name: tomcat
    emptyDir: {}
</code></pre>
<p>But this doesn't work because it just makes an empty ROOT folder under webapps which  Tomcat can't explode the WAR to because it expects to create ROOT it self.</p>
<p>I also tried this:</p>
<pre><code>    volumeMounts:
    - mountPath: //usr/local/tomcat/webapps
      name: tomcat
</code></pre>
<p>But now /webapps is just an empty folder because I assume I'm overwriting what the container is setting up for me when it starts up.</p>
<p>I'm obviously missing something fundemental here...I don't want to edit the image as I believe there must be another way around this I simply want /tomcat/webapps to be writable by the runAsUser which isn't root.</p>
<p>What is the best way to do this?</p>

trafalgar
<p>If you don't already have one, just create a Dockerfile for your image and add following lines into it:</p>
<pre><code>...

ENV USER=&lt;YOUR-CONTAINER-USER&gt;
ENV UID=10014
ENV GID=10014
RUN addgroup &quot;$USER&quot; --gid &quot;$GID&quot; \
    &amp;&amp; adduser \
    --disabled-password \
    --gecos &quot;&quot; \
    --home &quot;$(pwd)&quot; \
    --ingroup &quot;$USER&quot; \
    --no-create-home \
    --uid &quot;$UID&quot; \
    &quot;$USER&quot;
RUN chown -R &quot;$USER&quot;:&quot;$USER&quot; /usr/local/tomcat/webapps/ROOT

USER &quot;$USER&quot;

...
</code></pre>
