Answers: <p>After a while I found out that I need to declare the container to have a privileged security context. Suddenly it works!</p>
  <pre><code>spec:
    containers:
      - securityContext:
          privileged: true
  </code></pre>
  <p>There is also an article showing how to have a two-layered setup where the container that hosts the actual application does not need to be privileged: <a href="https://itnext.io/using-overlay-mounts-with-kubernetes-960375c05959" rel="nofollow noreferrer">https://itnext.io/using-overlay-mounts-with-kubernetes-960375c05959</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-08-08T08:33:37.060Z
Answers: 2021-08-08T08:33:37.060Z
Answers: peschü
Body: <p>I try to &quot;manually&quot; mount an overlayfs within a Kubernetes POD, to create a copy-on-write layer on top of a shared persistent volume.</p>
  <p>(For running a read-only postgres - postgres cannot run on a read-only filesystem because of locking.)</p>
  <p>So I created a volume</p>
  <pre><code>spec:
    volumes:
      - name: tempfs-volume
        emptyDir:
          medium: Memory
          sizeLimit: &quot;1Gi&quot;
  </code></pre>
  <p>and mount it under /opt/overlay:</p>
  <pre><code>spec:
    containers:
      - volumeMounts:
          - mountPath: /opt/pgdata_readonly
            name: my-postgres-volume
          - mountPath: /opt/overlay
            name: tempfs-volume```
  
  When I create the directories mentioned in the command below and do 
  
  </code></pre>
  <p>mount -t overlay -o lowerdir=/opt/pgdata_readonly,upperdir=/opt/overlay/upper,workdir=/opt/overlay/work overlay /opt/overlay/target</p>
  <pre><code>
  I get the error `mount: /opt/overlay/target: cannot mount overlay read-only.`
  
  I googled for quite a while and could not find a hint what could possibly go wrong here.
  This is in the Google cloud.
  </code></pre>
  
Tags: <kubernetes><postgresql><google-kubernetes-engine>
Title: mounting overlayfs within kubernetes POD - "cannot mount overlay read-only"
UserDisplayName: peschü
ThreadText: # mounting overlayfs within kubernetes POD - "cannot mount overlay read-only"
  
  (Asked by: username_0 on 2021-08-08)
  
  I try to "manually" mount an overlayfs within a Kubernetes POD, to create a copy-on-write layer on top of a shared persistent volume.
  
  (For running a read-only postgres - postgres cannot run on a read-only filesystem because of locking.)
  
  So I created a volume
  
  ```
  spec:
    volumes:
      - name: tempfs-volume
        emptyDir:
          medium: Memory
          sizeLimit: "1Gi"
  
  ```
  
  and mount it under /opt/overlay:
  
  ```
  spec:
    containers:
      - volumeMounts:
          - mountPath: /opt/pgdata_readonly
            name: my-postgres-volume
          - mountPath: /opt/overlay
            name: tempfs-volume```
  
  When I create the directories mentioned in the command below and do 
  
  ```
  
  mount -t overlay -o lowerdir=/opt/pgdata\_readonly,upperdir=/opt/overlay/upper,workdir=/opt/overlay/work overlay /opt/overlay/target
  
  ```
  
  I get the error `mount: /opt/overlay/target: cannot mount overlay read-only.`
  
  I googled for quite a while and could not find a hint what could possibly go wrong here.
  This is in the Google cloud.
  
  ```
  
  **Tags:** kubernetes, postgresql, google-kubernetes-engine
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-08-08. Score: 1
  
  After a while I found out that I need to declare the container to have a privileged security context. Suddenly it works!
  
  ```
  spec:
    containers:
      - securityContext:
          privileged: true
  
  ```
  
  There is also an article showing how to have a two-layered setup where the container that hosts the actual application does not need to be privileged: <https://itnext.io/using-overlay-mounts-with-kubernetes-960375c05959>
  
  
  ---
  
  