fix(dind): set fsGroup so executor can write to ephemeral scratch volume#882
Merged
Conversation
michaellzc
force-pushed
the
fix/dind-scratch-permissions
branch
from
50afb81 to
66999d7
Compare
Executors running in Docker mode (dind) prepare job workspaces by creating directories under $TMPDIR (/scratch). When storage.type is ephemeral, the PVC is mounted root:root 755 and the sourcegraph user (uid=100, gid=101) cannot create directories there. Added executor.podSecurityContext defaulting to fsGroup: 101, which causes Kubernetes to chown mounted volumes to the sourcegraph group on mount. This is a no-op for emptyDir (already 1777) and only matters for ephemeral PVCs. Root cause: Docker mode (EXECUTOR_USE_KUBERNETES=false) was only introduced in sourcegraph/sourcegraph#12881 — previously dind executors ran in KubernetesMode and never wrote to the local /scratch directory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
michaellzc
force-pushed
the
fix/dind-scratch-permissions
branch
from
66999d7 to
fe3ad24
Compare
marcleblanc2
approved these changes
Jun 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
executor.podSecurityContextdefaulting tofsGroup: 101so thesourcegraphuser (uid=100, gid=101) can write to the/scratchvolumepermission deniederrors when creating job workspace directories under/scratchwith ephemeral storageRoot cause
Executors running in Docker mode (dind) create job workspaces as directories under
$TMPDIR(/scratch). Whenstorage.type: ephemeral, the PVC is mountedroot:root 755— thesourcegraphnon-root user can't write to it.This was never hit before because dind executors previously ran in
emptyDironly, which is not affectedTest plan
storage.type: ephemeraland confirm workspace directories are created without permission errorsemptyDirdeployments are unaffected