<p>After a while I found out that I need to declare the container to have a privileged security context. Suddenly it works!</p>
<pre><code>spec:
  containers:
    - securityContext:
        privileged: true
</code></pre>
<p>There is also an article showing how to have a two-layered setup where the container that hosts the actual application does not need to be privileged: <a href="https://itnext.io/using-overlay-mounts-with-kubernetes-960375c05959" rel="nofollow noreferrer">https://itnext.io/using-overlay-mounts-with-kubernetes-960375c05959</a></p>

CC BY-SA 4.0
2021-08-08T08:33:37.060Z
2021-08-08T08:33:37.060Z
peschü
<p>I try to &quot;manually&quot; mount an overlayfs within a Kubernetes POD, to create a copy-on-write layer on top of a shared persistent volume.</p>
<p>(For running a read-only postgres - postgres cannot run on a read-only filesystem because of locking.)</p>
<p>So I created a volume</p>
<pre><code>spec:
  volumes:
    - name: tempfs-volume
      emptyDir:
        medium: Memory
        sizeLimit: &quot;1Gi&quot;
</code></pre>
<p>and mount it under /opt/overlay:</p>
<pre><code>spec:
  containers:
    - volumeMounts:
        - mountPath: /opt/pgdata_readonly
          name: my-postgres-volume
        - mountPath: /opt/overlay
          name: tempfs-volume```

When I create the directories mentioned in the command below and do 

</code></pre>
<p>mount -t overlay -o lowerdir=/opt/pgdata_readonly,upperdir=/opt/overlay/upper,workdir=/opt/overlay/work overlay /opt/overlay/target</p>
<pre><code>
I get the error `mount: /opt/overlay/target: cannot mount overlay read-only.`

I googled for quite a while and could not find a hint what could possibly go wrong here.
This is in the Google cloud.
</code></pre>

<kubernetes><postgresql><google-kubernetes-engine>
mounting overlayfs within kubernetes POD - "cannot mount overlay read-only"
peschü
# mounting overlayfs within kubernetes POD - "cannot mount overlay read-only"

(Asked by: username_0 on 2021-08-08)

I try to "manually" mount an overlayfs within a Kubernetes POD, to create a copy-on-write layer on top of a shared persistent volume.
(For running a read-only postgres - postgres cannot run on a read-only filesystem because of locking.)
So I created a volume
spec:
  volumes:
    - name: tempfs-volume
      emptyDir:
        medium: Memory
        sizeLimit: "1Gi"

and mount it under /opt/overlay:
spec:
  containers:
    - volumeMounts:
        - mountPath: /opt/pgdata_readonly
          name: my-postgres-volume
        - mountPath: /opt/overlay
          name: tempfs-volume```

When I create the directories mentioned in the command below and do 


mount -t overlay -o lowerdir=/opt/pgdata_readonly,upperdir=/opt/overlay/upper,workdir=/opt/overlay/work overlay /opt/overlay/target

I get the error `mount: /opt/overlay/target: cannot mount overlay read-only.`

I googled for quite a while and could not find a hint what could possibly go wrong here.
This is in the Google cloud.

**Tags:** kubernetes, postgresql, google-kubernetes-engine


---

## 1 answers

### Answer by username_0 on 2021-08-08. Score: 1

After a while I found out that I need to declare the container to have a privileged security context. Suddenly it works!
spec:
  containers:
    - securityContext:
        privileged: true

There is also an article showing how to have a two-layered setup where the container that hosts the actual application does not need to be privileged: https://itnext.io/using-overlay-mounts-with-kubernetes-960375c05959


---

