title: Kubernetes, security context, fsGroup field and default user's group ID running the container
body: <p>I'm new to Kubernetes and I'm trying to understand some security stuff.</p>
  
  <p>My question is about the Group ID (= gid) of the user running the container.</p>
  
  <p>I create a Pod using this official example: <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod" rel="noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod</a></p>
  
  <pre><code>apiVersion: v1
  kind: Pod
  metadata:
    name: security-context-demo
  spec:
    securityContext:
      runAsUser: 1000
      fsGroup: 2000
    volumes:
    - name: sec-ctx-vol
      emptyDir: {}
    containers:
    - name: sec-ctx-demo
      image: gcr.io/google-samples/node-hello:1.0
      volumeMounts:
      - name: sec-ctx-vol
        mountPath: /data/demo
      securityContext:
        allowPrivilegeEscalation: false
  </code></pre>
  
  <p>In the documentation, they say:</p>
  
  <blockquote>
    <p>In the configuration file, the <strong>runAsUser</strong> field specifies that for any
    Containers in the Pod, the <strong>first process runs with user ID 1000</strong>. The
    <strong>fsGroup</strong> field specifies that <strong>group ID 2000 is associated with all</strong>
    <strong>Containers in the Pod</strong>. Group ID 2000 is also associated with the
    volume mounted at /data/demo and with any files created in that
    volume.</p>
  </blockquote>
  
  <p>So, I go into the container:</p>
  
  <pre><code>kubectl exec -it security-context-demo -- sh
  </code></pre>
  
  <p>I see that the first process (i.e. with PID 1) is running with user 1000 => OK, that's the behavior I expected.</p>
  
  <pre><code> $ ps -f -p 1
   UID        PID  PPID  C STIME TTY          TIME CMD
   1000         1     0  0 13:06 ?        00:00:00 /bin/sh -c node server.js
  </code></pre>
  
  <p>Then, I create a file "testfile" in folder /data/demo. This file belongs to group "2000" because /data/demo has the "s" flag on group permission:</p>
  
  <pre><code>$ ls -ld /data/demo
  drwxrwsrwx 3 root 2000 39 Dec 29 13:26 /data/demo
  $ echo hello &gt; /data/demo/testfile
  $ ls -l /data/demo/testfile
  -rw-r--r-- 1 1000 2000 6 Dec 29 13:29 /data/demo/testfile
  </code></pre>
  
  <p>Then, I create a subfolder "my-folder" and remove the "s" flag on group permission. I create a file "my-file" in this folder:</p>
  
  <pre><code>$ mkdir /data/demo/my-folder
  $ ls -ld /data/demo/my-folder
  drwxr-sr-x 2 1000 2000 6 Dec 29 13:26 /data/demo/my-folder
  $ chmod g-s /data/demo/my-folder
  $ ls -ld /data/demo/my-folder
  drwxr-xr-x 2 1000 2000 6 Dec 29 13:26 /data/demo/my-folder
  $ touch /data/demo/my-folder/my-file
  $ ls -l /data/demo/my-folder/my-file
  -rw-r--r-- 1 1000 root 0 Dec 29 13:27 /data/demo/my-folder/my-file
  </code></pre>
  
  <p>I'm surprised that this file belongs to group "root", i.e. group with GID 0.
  I expected that it should belong to group "2000" according to this sentence in the documentation:</p>
  
  <blockquote>
    <p>The fsGroup field specifies that group ID 2000 is associated with all
    Containers in the Pod</p>
  </blockquote>
  
  <p>With the following commands, I see that user with UID "1000" in the container has primary Unix group "0", not 2000.</p>
  
  <pre><code>$ id
  uid=1000 gid=0(root) groups=0(root),2000
  $ cat /proc/1/status
  ...
  Pid:    1
  ...
  Uid:    1000    1000    1000    1000
  Gid:    0   0   0   0
  ...
  Groups: 2000 
  ...
  </code></pre>
  
  <p>Does anyone have some explanations?</p>
  
  <p>Why is not the user's GID set to the value of "fsGroup" field in the Pod's security context?</p>
  
  <p>Why the user's GID is set to 0 = root?</p>
  
  <p>Is it a bug in Kubernetes (I'm using v1.8.0)?</p>
  
  <p>Did I misunderstand the documentation?</p>
  
  <p>Thanks!</p>