<p>I am trying to run an nginx image as unprivileged, and found the following command stanza required to make this happen. I am NOT concerned with running the official nginx-unprivileged image, as that would defeat the purpose of the exercise (don't ask why...please).</p>
<p>Intended commands to convert from linux terminal style to Kubernetes YAML Pod manifest init-container section...</p>
<pre><code>RUN sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf \
    &amp;&amp; sed -i '/user  nginx;/d' /etc/nginx/nginx.conf \
    &amp;&amp; sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
    &amp;&amp; sed -i &quot;/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n&quot; /etc/nginx/nginx.conf \
    &amp;&amp; chown -R 101:0 /var/cache/nginx \
    &amp;&amp; chmod -R g+w /var/cache/nginx \
    &amp;&amp; chown -R 101:0 /etc/nginx \
    &amp;&amp; chmod -R g+w /etc/nginx
</code></pre>
<p>I have tried the following using block scalars to no avail...</p>
<pre><code>...
command: [&quot;/bin/sh&quot;, &quot;-c&quot;]
args: 
- &gt;
  sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf \
  &amp;&amp; sed -i '/user  nginx;/d' /etc/nginx/nginx.conf \
  &amp;&amp; sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
  &amp;&amp; sed -i &quot;/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n&quot; /etc/nginx/nginx.conf \
  &amp;&amp; chown -R 101:0 /var/cache/nginx \
  &amp;&amp; chmod -R g+w /var/cache/nginx \
  &amp;&amp; chown -R 101:0 /etc/nginx \
  &amp;&amp; chmod -R g+w /etc/nginx
...


...
command: [&quot;/bin/sh&quot;, &quot;-c&quot;]
args: 
- |
  sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf \
  &amp;&amp; sed -i '/user  nginx;/d' /etc/nginx/nginx.conf \
  &amp;&amp; sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
  &amp;&amp; sed -i &quot;/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n&quot; /etc/nginx/nginx.conf \
  &amp;&amp; chown -R 101:0 /var/cache/nginx \
  &amp;&amp; chmod -R g+w /var/cache/nginx \
  &amp;&amp; chown -R 101:0 /etc/nginx \
  &amp;&amp; chmod -R g+w /etc/nginx
...
</code></pre>
<p>Also using a single line...</p>
<pre><code>...
    command: [&quot;/bin/sh&quot;]
    args: [&quot;-c&quot;, &quot;sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf &amp;&amp; sed -i '/user  nginx;/d' /etc/nginx/nginx.conf &amp;&amp; sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf &amp;&amp; sed -i &quot;/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n&quot; /etc/nginx/nginx.conf &amp;&amp; chown -R 101:0 /var/cache/nginx &amp;&amp; chmod -R g+w /var/cache/nginx &amp;&amp; chown -R 101:0 /etc/nginx &amp;&amp; chmod -R g+w /etc/nginx&quot;]
...
</code></pre>
<p>None of these worked...the init-container never starts.</p>
<p>Here is another attempt...but the initContainer remains in a crashloopbackoff state...</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: securityreview
spec:
  securityContext:
    runAsUser: 101
    runAsNonRoot: True
  initContainers:
  - name: permission-fix
    image: nginx
    command:
    - /bin/sh
    - -c
    - sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf
      &amp;&amp; sed -i '/user  nginx;/d' /etc/nginx/nginx.conf
      &amp;&amp; sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf
      &amp;&amp; sed -i &quot;/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    
      fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    
      scgi_temp_path /tmp/scgi_temp;\n&quot; /etc/nginx/nginx.conf
      &amp;&amp; chown -R 101:0 /var/cache/nginx &amp;&amp; chmod -R g+w /var/cache/nginx
      &amp;&amp; chown -R 101:0 /etc/nginx &amp;&amp; chmod -R g+w /etc/nginx
  containers:
  - name: webguy
    image: nginx
    securityContext:
      runAsUser: 101
      runAsGroup: 101
      allowPrivilegeEscalation: false
</code></pre>

EMP JCR
<p>I like to use the following approach to separating multiple commands in a readable way:</p>
<pre><code>command: [&quot;/bin/sh&quot;, &quot;-c&quot;]
args:
  - &gt;
    command1 &amp;&amp;
    command2 &amp;&amp;
    ...
    commandN
</code></pre>
<p>However, your case is more complicated, as running <code>sed</code>, <code>chown</code> and <code>chmod</code> commands without root privileges will result in a <code>Permission denied</code> error.</p>
<p>You can use an init container that shares a Volume with the nginx container.
The init container will run the <code>sed</code>,<code>chown</code> and <code>chmod</code> commands as <code>root</code> and then copy the modified files to the shared Volume that will be mounted and used by the nginx container. In this approach, you need a volume that init and application containers can use.<br />
A similar use case can be found in the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-initialization/#create-a-pod-that-has-an-init-container" rel="nofollow noreferrer">Configure Pod Initialization</a> documentation.</p>
<p>I will create an example to illustrate how it works.</p>
<hr />
<p>As you can see in the code snippet below, I created the <code>permission-fix</code> init container that runs required commands and then copies modified files to the shared volume (<code>cp -Rp /etc/nginx/* /mnt/nginx-fix/</code>). The <code>webguy</code> container then mounts these files to <code>/etc/nginx</code>:</p>
<pre><code>$ cat nginx-unpriv.yml
apiVersion: v1
kind: Pod
metadata:
  name: securityreview
spec:
  initContainers:
  - name: permission-fix
    image: nginx
    command: [&quot;/bin/sh&quot;, &quot;-c&quot;]
    args:
      - &gt;
        sed -i 's,listen       80;,listen       8080;,' /etc/nginx/conf.d/default.conf &amp;&amp;
        sed -i '/user  nginx;/d' /etc/nginx/nginx.conf &amp;&amp;
        sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf &amp;&amp;
        sed -i &quot;/^http {/a \    proxy_temp_path /tmp/proxy_temp;\n    client_body_temp_path /tmp/client_temp;\n    fastcgi_temp_path /tmp/fastcgi_temp;\n    uwsgi_temp_path /tmp/uwsgi_temp;\n    scgi_temp_path /tmp/scgi_temp;\n&quot; /etc/nginx/nginx.conf &amp;&amp;
        chown -R 101:0 /var/cache/nginx &amp;&amp;
        chmod -R g+w /var/cache/nginx &amp;&amp;
        chown -R 101:0 /etc/nginx &amp;&amp;
        chmod -R g+w /etc/nginx &amp;&amp;
        cp -Rp /etc/nginx/* /mnt/nginx-fix/
    volumeMounts:    
    - name: nginx-fix
      mountPath: &quot;/mnt/nginx-fix&quot;
  containers:
  - name: webguy
    image: nginx
    volumeMounts:
    - name: nginx-fix
      mountPath: &quot;/etc/nginx&quot;
    securityContext:
      runAsUser: 101
      runAsGroup: 101
      allowPrivilegeEscalation: false
  volumes:
    - name: nginx-fix
      persistentVolumeClaim:
        claimName: myclaim
</code></pre>
<p>We can check if it works as expected:</p>
<pre><code>$ kubectl apply -f nginx-unpriv.yml
pod/securityreview created

$ kubectl get pods
NAME             READY   STATUS    RESTARTS   AGE
securityreview   1/1     Running   0          12s

$ kubectl exec -it securityreview  -c webguy -- bash
nginx@securityreview:/$ id
uid=101(nginx) gid=101(nginx) groups=101(nginx)

nginx@securityreview:/$ ls -l /etc/nginx
total 44
drwxrwxr-x 2 nginx root  4096 Jun 10 13:18 conf.d
-rw-rw-r-- 1 nginx root  1007 May 25 12:28 fastcgi_params
drwx------ 2 root  root 16384 Jun 10 13:18 lost+found
-rw-rw-r-- 1 nginx root  5290 May 25 12:28 mime.types
lrwxrwxrwx 1 nginx root    22 May 25 13:01 modules -&gt; /usr/lib/nginx/modules
-rw-rw-r-- 1 nginx root   826 Jun 10 13:18 nginx.conf
-rw-rw-r-- 1 nginx root   636 May 25 12:28 scgi_params
-rw-rw-r-- 1 nginx root   664 May 25 12:28 uwsgi_params
</code></pre>
<p>If this response does not answer your question, please provide more details on what you want to achieve.</p>
