How to set filesystem permissions on Volumes for non-root containers

3 min read

As a best practice we should try run containers with the minimum privileges they require: If we want to run a container with a non-root user we need to specify the user we want to use with securityContext.runAsUser (unless the container is not already using a non-privileged user).

By doing so when working with Volumes we might get a Permission denied while accessing the container

18/02/2022

fsGroupChangePolicy for Kubernetes Volumes

2 min read

When running a pod as a non-root user, you must specify a fsGroup in the securityContext section so that the volume can be readable and writable by the Pod.

01/02/2022

Expose Pod information using an volume

2 min read

We can choose to expose some of the Pod's information as volumes or environment variables using DownwardAPIVolumeFile. It can expose both Pod fields and Container fields

05/01/2022

Kubernetes Pod: Share a temporal Volume across containers

2 min read

If we need to be able to share some data across containers (one generates the data and the other one consumes it) we can use an emptyDir to create a Volume to mount on both containers.

30/06/2021

How kubernetes hides away the volumeMounts complexity

4 min read

If we try compare volumeMounts with the actual mounts that we have on a pod using, for example, df it can be quite confusing due to the usage of the overlay filesystem

Let's consider the volumeMounts section of a deploy:

$ kubectl get deploy pet2cattle -o yaml (...)  volumeMounts:  - mountPath: /opt/pet2cattle/conf  name: config  - mountPath: /opt/pet2cattle/data  name: pet2cattle  subPath: data  - mountPath: /opt/pet2cattle/lib  name: pet2cattle  subPath: lib  - mountPath: /tmp  name: tmp-dir (...) 

And compare it with the filesystem we see on the pod:

$ kubectl exec pet2cattle-8475d6697-jbmsm -- df -hP Filesystem Size Used Avail Use% Mounted on overlay 100G 9.7G 91G 10% / tmpfs 64M 0 64M 0% /dev tmpfs 3.9G 0 3.9G 0% /sys/fs/cgroup /dev/xvda1 100G 9.7G 91G 10% /tmp shm 64M 0 64M 0% /dev/shm /dev/xvdcu 20G 2.5G 18G 13% /opt/pet2cattle/lib tmpfs 3.9G 12K 3.9G 1% /run/secrets/kubernetes.io/serviceaccount tmpfs 3.9G 0 3.9G 0% /proc/acpi tmpfs 3.9G 0 3.9G 0% /proc/scsi tmpfs 3.9G 0 3.9G 0% /sys/firmware 

13/04/2021