Permission denied for files inside the draw folder

[alex98RB]

I'm running the image in an OpenShift environment, which, for security purposes, executes containers with a random non-root user..
My issue is that the docker-entrypoint.sh script tries to write to files such as PreConfig.js, PostConfig.js, .keystore and more, but it fails with a Permission denied error because the user doesn't have the necessary write permissions.

Even if I add the user to the same group as the tomcat user, it still doesn't work — the group only has read access, not write access to these files.

Is it possible to modify the group permissions of all those files inside the /usr/local/tomcat/webapps/draw/ so that users in the tomcat group can write to them? Or do you suggest an alternative solution?

[odellem]

It would be easier to set the user in the deployment and add the anyuid permission to the serviceaccount.

Add the scc to your deployment:

spec:
  template:
    spec:
      containers:
        - securityContext:
            runAsUser: 1001
            runAsGroup: 999

Add the policy to the serviceaccount:

oc adm policy add-scc-to-user anyuid -n <namespace> -z default

You can also create your own service account to be separate from default