title: Kubernetes Permission denied in container
body: <p>My company bought a software we're trying to deploy on IBM cloud, using kubernetes and given private docker repository. Once deployed, there is always a Kubernetes error : &quot;Back-off restarting failed container&quot;. So I read logs in order to understand why the container is restarting and here is the error :</p>
  <pre><code>Caused by: java.io.FileNotFoundException: /var/yseop-log/yseop-manager.log (Permission denied)
  </code></pre>
  <p>So I deduced that I just had to change permissions in the Kubernetes file. Since I'm using a deployment, I tried the following initContainer :</p>
  <pre><code>initContainers:
      - name: permission-fix
        image: busybox
        command: ['sh', '-c']
        args: ['chmod -R 777 /var']
        volumeMounts:
          - mountPath: /var/yseop-engine
            name: yseop-data
          - mountPath: /var/yseop-data/yseop-manager
            name: yseop-data
          - mountPath: /var/yseop-log
            name: yseop-data
  </code></pre>
  <p>This didn't worked because I'm not allowed to execute chmod on read-only folders as non root user.</p>
  <p>So I tried remounting those volumes, but that also failed, because I'm not a root user.</p>
  <p>I then found out about running as User and group. In order to find out which User and group I had to write in my security context, I read the dockerfile and here is the user and group :</p>
  <pre><code> USER 1001:0
  </code></pre>
  <p>So I tought I could just write this in my deployment file :</p>
  <pre><code>  securityContext: 
        runAsUser: 1001  
        rusAsGroup: 0
  </code></pre>
  <p>Obvisouly, that didn't worked neither, because I'm not allowed to run as group 0</p>
  <p>So I still don't know what to do in order to properly deploy this image. The image is working when doing a docker pull and exec on m computer, but it's not working on Kubernetes.</p>
  <p>Here is my complete Volume file :</p>
  <pre><code>apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    annotations:
      ibm.io/auto-create-bucket: &quot;true&quot;
      ibm.io/auto-delete-bucket: &quot;false&quot;
      ibm.io/bucket: &quot;&quot;
      ibm.io/secret-name: &quot;cos-write-access&quot;
      ibm.io/endpoint: https://s3.eu-de.cloud-object-storage.appdomain.cloud
    name: yseop-pvc
    namespace: ns
    labels:
      app: yseop-pvc
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: 10Gi
    storageClassName: ibmc
    volumeMode: Filesystem 
  </code></pre>
  <p>And here is my full deployment file :</p>
  <pre><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: yseop-manager
    namespace: ns
  spec:
    selector:
      matchLabels:
        app: yseop-manager
    template:
      metadata:
        labels:
          app: yseop-manager
      spec:
        securityContext: 
            runAsUser: 1001  
            rusAsGroup: 0
        initContainers:
          - name: permission-fix
            image: busybox
            command: ['sh', '-c']
            args: ['chmod -R 777 /var']
            volumeMounts:
              - mountPath: /var/yseop-engine
                name: yseop-data
              - mountPath: /var/yseop-data/yseop-manager
                name: yseop-data
              - mountPath: /var/yseop-log
                name: yseop-data
        containers:
          - name: yseop-manager
            image:IMAGE
            imagePullPolicy: IfNotPresent
            env:
              - name: SECURITY_USERS_DEFAULT_ENABLED
                value: &quot;true&quot;
            ports:
              - containerPort: 8080
            volumeMounts:
              - mountPath: /var/yseop-engine
                name: yseop-data
              - mountPath: /var/yseop-data/yseop-manager
                name: yseop-data
              - mountPath: /var/yseop-log
                name: yseop-data
        imagePullSecrets:
          - name: regcred
        volumes:
          - name: yseop-data
            persistentVolumeClaim:
              claimName: yseop-pvc
  </code></pre>
  <p>Thanks for helping</p>