<p>You have a main container that needs access to a volume, but it encounters a permission issue. You can use an init container to set the correct permissions on the volume</p>
<pre><code>initContainers:
      - name: setup-permissions
        image: busybox
        command: [&quot;sh&quot;, &quot;-c&quot;, &quot;chmod 755 -R /var/lib/grafana&quot;]  # Set permissions for the volume
        volumeMounts:
          - name: grafana-storage
            mountPath: /var/lib/grafana
</code></pre>
<p>To fix permission issues using an init container</p>

CC BY-SA 4.0
2024-09-04T17:53:03.010Z
2024-09-04T17:53:03.010Z
playwithcode
<p>You have multiples solutions</p>
<h3>1 - Set a uid and gid when creating the mount</h3>
<p>This imply knowing the uid and gid of the user running inside your pod. To get it you could do something like this :</p>
<pre class="lang-shell prettyprint-override"><code>$ kubectl run -ti debug --image grafana/grafana --command bash
If you don't see a command prompt, try pressing enter.
debug:/usr/share/grafana$ id
uid=472(grafana) gid=0(root) groups=0(root)
</code></pre>
<p>Then when creating the mount with minikube, set the uid and gid</p>
<pre class="lang-shell prettyprint-override"><code>$ minikube mount /var/tmp/minikube-folder1:/folder1 --uid 472 --gid 0
</code></pre>
<p>Now in your pod you can see that the <code>/var/lib/grafana/</code> permissions are correct</p>
<pre class="lang-shell prettyprint-override"><code>grafana-57d4899dd7-fsp5z:/usr/share/grafana$ id
uid=472(grafana) gid=0(root) groups=0(root),47
grafana-57d4899dd7-fsp5z:/usr/share/grafana$ ls -lnd /var/lib/grafana/
drwxrwxr-x    1 472      0             4096 Aug 11 14:19 /var/lib/grafana/
</code></pre>
<h3>2 - Use a security context to run the pod</h3>
<p>Localy your folder is created with your user, you can tell your pod to use the same uid as your local user.</p>
<p>First you need to get the uid of the user who created <code>/var/tmp/minikube-folder1</code></p>
<pre class="lang-shell prettyprint-override"><code>$ ls -lnd /var/tmp/minikube-folder1
total 4
drwxrwxr-x 2 1000 1000 4096 août  11 16:06 /var/tmp/minikube-folder1
</code></pre>
<p>Let say the uid is 1000.</p>
<p>In your deployment configuration (grafana yaml), you can set the <code>runAsUser</code> directive :</p>
<pre class="lang-yaml prettyprint-override"><code>...
spec:
  template:
    spec:
      securityContext:
        runAsUser: 1000
      containers: 
...
</code></pre>
<p>Now if you check in your started pod you can see that it's started with uid 1000</p>
<pre class="lang-shell prettyprint-override"><code>$ kc exec -ti grafana-7c895564cc-w26p6 -- bash
grafana-7c895564cc-w26p6:/usr/share/grafana$ id
uid=1000 gid=0(root) groups=0(root),472
</code></pre>
<p>And that's the same user as the <code>/var/lib/grafana/</code> folder in the pod :</p>
<pre class="lang-shell prettyprint-override"><code>grafana-5f75d8ff65-dhbb5:/usr/share/grafana$ ls -lnd /var/lib/grafana/
drwxrwxr-x    1 1000     999           4096 Aug 11 14:16 /var/lib/grafana/
</code></pre>
<p>Hope this is clear and that it helps !</p>

CC BY-SA 4.0
2023-08-11T14:23:21.780Z
2023-08-11T14:23:21.780Z
Paul
<p>I have a minikube cluster with a grafana pod running in it.</p>
<p>I have mounted a directory for grafana to use as a persistant volume to store.
<code>minikube mount /var/tmp/minikube-folder1:/folder1</code></p>
<p>I receive the output</p>
<pre><code>  Mounting host path /var/tmp/minikube-folder1 into VM as /folder1 ...
    ▪ Mount type:   9p
    ▪ User ID:      docker
    ▪ Group ID:     docker
    ▪ Version:      9p2000.L
    ▪ Message Size: 262144
    ▪ Options:      map[]
    ▪ Bind Address: 127.0.0.1:64221
  Userspace file server: ufs starting
✅  Successfully mounted /var/tmp/minikube-folder1 to /folder1
</code></pre>
<p>i bind to the folder as such in my grafana yaml</p>
<pre><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-grafana
spec:
  volumeName: grafana-pv
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: grafana-pv
spec:
  storageClassName: standard
  accessModes:
    - ReadWriteMany
  capacity:
    storage: 2Gi
  hostPath:
    path: /folder1
</code></pre>
<p>and eventually mount it on my container as such</p>
<pre><code>   [spec..tempalate..spec above]

    containers:
      - name: mygrafana
        image: grafana/grafana
        ports:
          - containerPort: 3000 
        volumeMounts:
          - name: grafana-storage
            mountPath: /var/lib/grafana

     volumes:
       - name: grafana-storage
         persistentVolumeClaim:
            claimName: pvc-grafana
</code></pre>
<p>my grafana pod cant launch and always complains the permissions arent correct on <code>/var/lib/grafana</code></p>
<p>I can remedy it by manually going into <code>/var/tmp/minikube-folder1/</code> and <code>chmod 777</code>ing the folders each time a new one appears (ex /var/lib/grafana/alerting), but this seems like an inefficient and wrong strategy.</p>
<p>Is there someway to not have the minikube setup have these filesystem permission conflicts?</p>

<kubernetes><grafana><persistent-volumes>
How to set correct mount permissions of Minikube grafana pod
Ryu S.
# How to set correct mount permissions of Minikube grafana pod

(Asked by: username_0 on 2023-08-10)

I have a minikube cluster with a grafana pod running in it.
I have mounted a directory for grafana to use as a persistant volume to store.
minikube mount /var/tmp/minikube-folder1:/folder1
I receive the output
  Mounting host path /var/tmp/minikube-folder1 into VM as /folder1 ...
    ▪ Mount type:   9p
    ▪ User ID:      docker
    ▪ Group ID:     docker
    ▪ Version:      9p2000.L
    ▪ Message Size: 262144
    ▪ Options:      map[]
    ▪ Bind Address: 127.0.0.1:64221
  Userspace file server: ufs starting
✅  Successfully mounted /var/tmp/minikube-folder1 to /folder1

i bind to the folder as such in my grafana yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-grafana
spec:
  volumeName: grafana-pv
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: grafana-pv
spec:
  storageClassName: standard
  accessModes:
    - ReadWriteMany
  capacity:
    storage: 2Gi
  hostPath:
    path: /folder1

and eventually mount it on my container as such
   [spec..tempalate..spec above]

    containers:
      - name: mygrafana
        image: grafana/grafana
        ports:
          - containerPort: 3000 
        volumeMounts:
          - name: grafana-storage
            mountPath: /var/lib/grafana

     volumes:
       - name: grafana-storage
         persistentVolumeClaim:
            claimName: pvc-grafana

my grafana pod cant launch and always complains the permissions arent correct on /var/lib/grafana
I can remedy it by manually going into /var/tmp/minikube-folder1/ and chmod 777ing the folders each time a new one appears (ex /var/lib/grafana/alerting), but this seems like an inefficient and wrong strategy.
Is there someway to not have the minikube setup have these filesystem permission conflicts?

**Tags:** kubernetes, grafana, persistent-volumes


---

## 2 answers

### Answer by username_1 on 2024-09-04. Score: 0

You have a main container that needs access to a volume, but it encounters a permission issue. You can use an init container to set the correct permissions on the volume
initContainers:
      - name: setup-permissions
        image: busybox
        command: ["sh", "-c", "chmod 755 -R /var/lib/grafana"]  # Set permissions for the volume
        volumeMounts:
          - name: grafana-storage
            mountPath: /var/lib/grafana

To fix permission issues using an init container


---

### Answer by username_2 on 2023-08-11. Score: 0

You have multiples solutions
1 - Set a uid and gid when creating the mount
This imply knowing the uid and gid of the user running inside your pod. To get it you could do something like this :
$ kubectl run -ti debug --image grafana/grafana --command bash
If you don't see a command prompt, try pressing enter.
debug:/usr/share/grafana$ id
uid=472(grafana) gid=0(root) groups=0(root)

Then when creating the mount with minikube, set the uid and gid
$ minikube mount /var/tmp/minikube-folder1:/folder1 --uid 472 --gid 0

Now in your pod you can see that the /var/lib/grafana/ permissions are correct
grafana-57d4899dd7-fsp5z:/usr/share/grafana$ id
uid=472(grafana) gid=0(root) groups=0(root),47
grafana-57d4899dd7-fsp5z:/usr/share/grafana$ ls -lnd /var/lib/grafana/
drwxrwxr-x    1 472      0             4096 Aug 11 14:19 /var/lib/grafana/

2 - Use a security context to run the pod
Localy your folder is created with your user, you can tell your pod to use the same uid as your local user.
First you need to get the uid of the user who created /var/tmp/minikube-folder1
$ ls -lnd /var/tmp/minikube-folder1
total 4
drwxrwxr-x 2 1000 1000 4096 août  11 16:06 /var/tmp/minikube-folder1

Let say the uid is 1000.
In your deployment configuration (grafana yaml), you can set the runAsUser directive :
...
spec:
  template:
    spec:
      securityContext:
        runAsUser: 1000
      containers: 
...

Now if you check in your started pod you can see that it's started with uid 1000
$ kc exec -ti grafana-7c895564cc-w26p6 -- bash
grafana-7c895564cc-w26p6:/usr/share/grafana$ id
uid=1000 gid=0(root) groups=0(root),472

And that's the same user as the /var/lib/grafana/ folder in the pod :
grafana-5f75d8ff65-dhbb5:/usr/share/grafana$ ls -lnd /var/lib/grafana/
drwxrwxr-x    1 1000     999           4096 Aug 11 14:16 /var/lib/grafana/

Hope this is clear and that it helps !


---

