Recommended Free Tools
A pod can run as a non-root user and still receive “permission denied” on a mounted path: the process UID and GID are separate from the volume’s ownership and access rules. Diagnose both, then choose a fix supported by the volume type and storage driver. In Kubernetes, runAsUser and runAsGroup set process identity; fsGroup can provide group access to supported volumes. Docker host-path bind mounts are a related but distinct case, governed by host permissions and, in rootless mode, UID/GID mapping.
Why a mounted file or directory returns “permission denied”
Linux checks the running process’s user and groups against the file or directory’s owner, group, and mode bits. For a directory, the process also needs execute permission to traverse it; checking only the target file’s read or write bits can miss a restrictive parent directory. The mounted storage implementation may also affect ownership and access behavior.
As an Amazon Associate I earn from qualifying purchases.
In Kubernetes, runAsUser and runAsGroup set the process UID and primary GID. They do not, by themselves, make a mounted directory writable. Pod-level fsGroup is a separate group-access setting used for supported volumes. Which behavior applies depends on the volume type and storage driver. See the Kubernetes documentation on configuring a security context and volumes.
Diagnose the identity and the mounted path
- Identify the volume and driver. Determine whether the path comes from a persistent volume,
emptyDir,secret,configMap, or another source. For CSI-backed storage, check whether the driver supportsVOLUME_MOUNT_GROUP. - Inspect the process identity. Run
idinside the container to see its UID, primary GID, and supplementary groups. - Inspect numeric ownership and modes. Use
ls -ln /pathorstat /pathinside the container. Check the file or directory and each parent directory in the path. - Compare access requirements. Match the process UID and groups against the owner, group, and mode bits. Decide whether the application needs read, write, or directory traversal access, and grant only what it needs.
- Choose a volume-appropriate fix. Consider
fsGrouponly where the volume and driver support its group-access behavior. For ephemeral volume types, inspect their specific mode options and the application’s expectations instead. - Check mount intent. For Docker bind mounts, verify host-side permissions and whether the mount is read-only. If Docker is rootless, also account for UID/GID mapping.
When Kubernetes fsGroup and fsGroupChangePolicy help
For supported volumes, Kubernetes normally adjusts ownership and permissions recursively when a Pod specifies fsGroup. The policy fsGroupChangePolicy controls that work: Always checks and changes permissions on each mount, while OnRootMismatch can skip the recursive change if the volume root already has the expected ownership and permissions. On a large volume, avoiding an unnecessary recursive traversal can reduce startup delay. The root’s ownership and permissions must remain consistent for the skip condition to be appropriate.
#1 Best Overall
fsGroupChangePolicy does not apply to ephemeral secret, configMap, or emptyDir volumes. As Kubernetes states, “This field does not apply to ephemeral volume types such as secret, configMap, and emptyDir.” Do not treat setting fsGroup or the policy as a guaranteed recursive permission fix for those volume types.
CSI drivers may handle the mount group themselves
If a CSI driver supports the VOLUME_MOUNT_GROUP node capability, the driver handles the mount-group behavior. Kubernetes does not perform its own recursive ownership and permission change for that operation, so fsGroupChangePolicy has no effect on it. Confirm the storage class and driver behavior rather than assuming that all persistent volumes respond identically to fsGroup.
Rank #2
Example: Pod security-context field placement
This manifest illustrates where the fields appear; its emptyDir is not an example of a guaranteed recursive ownership fix. Use a supported persistent volume and validate its driver behavior when configuring ownership for production.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →apiVersion: v1
kind: Pod
metadata:
name: permission-example
spec:
securityContext:
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
fsGroupChangePolicy: OnRootMismatch
containers:
- name: app
image: example/image
command: ["sh", "-c", "id && ls -ln /data && sleep 3600"]
volumeMounts:
- name: data
mountPath: /data
volumes:
- name: data
emptyDir: {}The numeric IDs are illustrative, not universal recommendations. Pick values that align with the image, the files’ ownership, and the storage implementation. No manifest example can substitute for checking the identity and numeric permissions observed in the running container.
Rank #3
How Docker bind mounts differ
A Kubernetes volumeMount places a declared Pod volume at a container path. A Docker bind mount instead maps a host path directly into a container. Docker bind mounts are writable by default, and while mounted they hide any image content that was already at the destination path. Docker’s bind-mount documentation says, “Bind mounts have write access to files on the host by default.” Use a read-only mount if the container only needs to read the host files.
In Docker rootless mode, container UIDs and GIDs map to different host IDs, so ownership can look different inside the container and on the host. Check the mapping as well as host-side permissions using Docker’s UID/GID mapping documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the least-permissive working configuration
- Set the process UID and GID to the identity the application should use; do not expect those settings alone to change mounted-file ownership.
- Use a supported group-access mechanism such as
fsGrouponly after confirming volume and driver behavior. - Consider
OnRootMismatchwhen recursive permission work on a supported volume is costly and the root ownership invariant is maintained. - Keep mounts read-only when writes are unnecessary, and avoid broad permissions such as
chmod 777as a default fix. Broader modes weaken access controls and may not address UID/GID mapping or driver-specific behavior.
Kubernetes also documents bindMountOptions (noexec, nodev, nosuid) as an alpha, disabled-by-default feature beginning in v1.37. It requires container-runtime support and has no effect on Windows nodes; check the cluster version, feature gates, runtime, and node operating system before considering it. These options are not a general-purpose permission repair.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Best Value
- Docker, Docker Swarm, Docker Compose, Programmer, Developer, Coding, Programming, Software Engineer, Code, DevOps, Deploy, Deployment, Kubernetes, Salt, Puppet, Chef, Terraform, Container, AWS, Azure, Cloud, Geek, Funny, Computer, Software, Tech, IT
- Integration, Scrum, Compile, Compilation, Science, Bug, Debug, Python, Linux, Java, Javascript, Scala, Dotnet, Kotlin
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
