I've been tasked with getting our k8s deployment running as non-Root. A 3rd party library we use needs the home directory for the user to exist and have write access. I've tried using initContainers but any changes I make are essentially discarded, and of course I don't have permissions on the real container
I would like to avoid setting all this up in the Dockerfile. Is there anyway to create the user home directory for the user kubernetes container runs as?
Kubernetes uses a container engine to run a pod with a specific image. Most Pods can die at any time, therefore they must be either based on an image with the desired state or have state preserved in a different way.
If there is a state that you would like to preserve and using a Dockerfile / Custom Image is not an option, I suggest you either :
Set up a volume. volume mount the user directory so that the files are never deleted and permissions are preserved as well. https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
Run the container together with a sidecar. Create a pod that has a sidecar container which can run commands in the same network and can share a volume mount with the main container.
ie. perhaps you can create a shared volume, then create an image that chowns the directory as root and use this image for a sidecar container. https://kubernetes.io/docs/tasks/access-application-cluster/communicate-containers-same-pod-shared-volume/#creating-a-pod-that-runs-two-containers
However, the simplest solution could be to just modify permissions in the Dockerfile, for example by adding some lines to a Dockerfile. If you are adding lines to you your existing Dockerfile, make sure to add them before your CMD / ENTRYPOINT
If you are basing this image off of your already existing one, make sure to put this at the top of your Dockerfile
FROM Myoriginalimage
Dockerfile commands:
USER root RUN chown $USER:$USER_GROUP -R $USER_HOME_DIR USER $USER make sure your CMD/ENTRYPOINT comes after this if you are editing an existing Dockerfile
More info on Dockerfile: https://www.linode.com/docs/applications/containers/how-to-use-dockerfiles/
After that you can push to a registry, such as dockerhub, assuming you don't have a private registry or can't have access to one for whatever reason.
docker logindocker push your-imageSee here for more details: https://docs.docker.com/docker-hub/repos/