# Cannot run temporal services as non-root user in kubernetes **URL:** \ **Category:** Community Support\ **Tags:** kubernetes\ **Created:** [February 4, 2021, 2:33pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441 "2021-02-04T14:33:15Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![siva](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/siva/32/689_2.png) [@siva](https://community.temporal.io/u/siva)\ **Post date:** [February 4, 2021, 2:33pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/1 "2021-02-04T14:33:15Z")
We have restrictions in our enterprise k8s environment to block running containers as root user. Kubernetes also recommends running containers as non-root user - [11 Ways (Not) to Get Hacked | Kubernetes](https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#8-run-containers-as-a-non-root-user) Starting temporal containers (using the helm chart from temporal helm chart repo) as non-root user throws the below permission error: > - dockerize -template /etc/temporal/config/config\_template.yaml:/etc/temporal/config/docker.yaml > 2021/02/04 14:28:48 unable to create open /etc/temporal/config/docker.yaml: permission denied Currently, I did a workaround by creating a custom image with permission for non-root user to /etc/temporal/ dir. Can we update the dockerfile and helm chart to run temporal services as non-root user by default? ---
**Author:** ![Wenquan\_Xing](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/wenquan_xing/32/362_2.png) [@Wenquan\_Xing](https://community.temporal.io/u/Wenquan_Xing)\ **Post date:** [February 4, 2021, 9:28pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/2 "2021-02-04T21:28:03Z")
Hi Siva, Can you create an [github](https://github.com/temporalio/temporal) issue for this? ---
**Author:** ![siva](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/siva/32/689_2.png) [@siva](https://community.temporal.io/u/siva)\ **Post date:** [February 5, 2021, 12:38am UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/3 "2021-02-05T00:38:59Z")
Done - [Cannot run temporal services as non-root user in kubernetes · Issue #1263 · temporalio/temporal · GitHub](https://github.com/temporalio/temporal/issues/1263). Thanks! ---
**Author:** ![amlanroy1980](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@amlanroy1980](https://community.temporal.io/u/amlanroy1980)\ **Post date:** [March 23, 2021, 3:38pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/4 "2021-03-23T15:38:45Z")
Hi @Wenquan_Xing, Is there any timeline when this issue will be fixed? We are also facing the same problem. ---
**Author:** ![derek](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/derek/32/245_2.png) [@derek](https://community.temporal.io/u/derek)\ **Post date:** [March 23, 2021, 8:32pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/5 "2021-03-23T20:32:06Z")
this is on our radar and we do plan on eventually making this happen. at the same time, the work has not been scheduled yet. but there’s no reason temporal inherently needs to run with root and we’re totally open to accepting PRs to make this possible in the meantime. thank you for your feedback as interest in specific issues helps us to prioritize our efforts! ---
**Author:** ![sagardeo21](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sagardeo21/32/1144_2.png) [@sagardeo21](https://community.temporal.io/u/sagardeo21)\ **Post date:** [July 14, 2021, 3:31pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/6 "2021-07-14T15:31:39Z")
Hi @derek Is there any ETA on getting this rolled out? ---
**Author:** ![derek](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/derek/32/245_2.png) [@derek](https://community.temporal.io/u/derek)\ **Post date:** [July 14, 2021, 5:05pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/7 "2021-07-14T17:05:55Z")
definitely still open to PRs, no ETA. ---
**Author:** ![fivos](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/fivos/32/2415_2.png) [@fivos](https://community.temporal.io/u/fivos)\ **Post date:** [July 30, 2022, 11:58pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/8 "2022-07-30T23:58:46Z")
Hi, I have the same requirement to run temporal services as a non-root user and I see that the associated github issue was addressed with [this PR](https://github.com/temporalio/helm-charts/pull/221/files). I’m testing out a helm deployment using MySQL as the only dependency and I still end up with containers running as root. Looking at the helm template, I see that `securityContext` is preceded by this [if statement](https://github.com/temporalio/helm-charts/blob/master/templates/server-deployment.yaml#L48), which means that the securityContext is only added if either cassandra or elasticsearch are enabled. Could this be updated so that containers don’t run as root when using MySQL only? ---
**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\ **Post date:** [July 31, 2022, 8:51pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/9 "2022-07-31T20:51:19Z")
> Could this be updated so that containers don’t run as root when using MySQL only? Yes it can be imo. Could you [open issue in helm charts repo](https://github.com/temporalio/helm-charts/issues) and will add. ---
**Author:** ![fivos](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/fivos/32/2415_2.png) [@fivos](https://community.temporal.io/u/fivos)\ **Post date:** [August 1, 2022, 3:23am UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/10 "2022-08-01T03:23:18Z")
Thanks, I created [[Bug] Cannot run temporal services as non-root user in kubernetes · Issue #307 · temporalio/helm-charts · GitHub](https://github.com/temporalio/helm-charts/issues/307) ---
**Author:** ![fivos](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/fivos/32/2415_2.png) [@fivos](https://community.temporal.io/u/fivos)\ **Post date:** [August 2, 2022, 6:20pm UTC](https://community.temporal.io/t/cannot-run-temporal-services-as-non-root-user-in-kubernetes/1441/11 "2022-08-02T18:20:48Z")
I took a stab at addressing the issue with [Run as nonRoot with Cassandra and Elasticsearch disabled by fivos · Pull Request #308 · temporalio/helm-charts · GitHub](https://github.com/temporalio/helm-charts/pull/308/files)