<p>Given a pod running an Nginx container, and a PHP-FPM container, what would be the best practice for the applications document permissions?</p>
<p>At the moment I have a volume shared between the containers so that Nginx has access to the PHP files. This works, but the files are owned by the user <code>www-data</code> in the FPM container, which does not exist in the Nginx container, resulting in them being owned by whichever user has the same UID.</p>
<p>This is obviously wrong, but then what's right? Options I've considered so far:</p>
<ul>
<li>Files are owned by <code>nobody:nogroup</code></li>
<li>Make a copy of the files for Nginx, and assign ownership to the <code>nginx</code> user in that container</li>
<li>Align the UIDs</li>
<li>Run both Nginx and FPM in the same container</li>
</ul>
<p>None of these seem appealing.</p>

Afraz
<p>This is a case for <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">Security Context</a> in kubernetes, where you can specify uid,gid or supplementary gid (fsgroup) for your pods.</p>
<p>For example setting:</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
</code></pre>
<p>Will make you progress run as user 1000, with primary group 3000 and supplementary group 2000.</p>
<p>You haven't specified if you need both pods to edit files in that volume, if that's not the case - only adding <code>fsGroup</code> should be enough to give read-only rights (by default) to your files, without affecting your existing workloads in any meaningful way.</p>
<p>Otherwise you can force same UID's, but that might require you to reconfigure your applications</p>
<p>See also: <a href="https://stackoverflow.com/questions/66218961/kubernetes-how-to-correctly-set-php-fpm-and-nginx-shared-volume-permission">Kubernetes: how to correctly set php-fpm and nginx shared volume permission</a></p>
