Error: Permission Denied When runAsNonRoot Is Set in Kubernetes

Issue

Hybrid Deployment job containers fail with a permission error in the job logs. For example:

cp: cannot create regular file './code.zip': Permission denied

Environment

Container platform: Kubernetes

Resolution

Fivetran does not support cluster-enforced runAsNonRoot: true policies for Hybrid Deployment job containers.

To resolve the issue, configure your Kubernetes security policy to exempt the Hybrid Deployment namespace from the non-root requirement. Then restart the affected Hybrid Deployment jobs.

You can enable the use_security_context parameter to apply additional security restrictions to Hybrid Deployment job containers while allowing them to run as the root user. This parameter prevents privilege escalation, makes the container root filesystem read-only, and drops all Linux capabilities. It does not set runAsUser or runAsNonRoot.

Cause

This error can occur when your Kubernetes cluster enforces a security policy that configures Hybrid Deployment job containers to run as a non-root user. For example:

securityContext:
  runAsUser: 1001280000
  runAsNonRoot: true

Hybrid Deployment job containers require root user access to perform certain operations. Therefore, policies that enforce runAsNonRoot: true can prevent the containers from accessing or modifying the required files.