# Read only root file system

**URL:** <https://community.replicated.com/t/read-only-root-file-system/1331>\
**Category:** Troubleshooting\
**Tags:** kots\
**Created:** [December 6, 2023, 10:58am UTC](https://community.replicated.com/t/read-only-root-file-system/1331 "2023-12-06T10:58:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rosmolak](https://avatars.discourse-cdn.com/v4/letter/r/b5a626/32.png) [@rosmolak](https://community.replicated.com/u/rosmolak)\
**Post date:** [December 6, 2023, 10:58am UTC](https://community.replicated.com/t/read-only-root-file-system/1331/1 "2023-12-06T10:58:04Z")

</div>

Hi,  
i am trying to deploy KOTS admin console on shared cluster with strict container security policies,  
i generated manifest as KOTS install was not working directly,  
however --strict-security-context cannot be used to generate manifests with restricted security context,  
i was able to make minio stateful set up and running but rqlite and kotsadm are still giving me similar errors:

“must-have-readonlyrootfilesystem only read-only root filesystem container is allowed”

my context looks like this:  
securityContext:  
capabilities:  
drop:  
- ALL  
privileged: false  
runAsUser: 1001  
runAsGroup: 1001  
runAsNonRoot: true  
readOnlyRootFilesystem: true  
allowPrivilegeEscalation: false

and syntax is applied correctly

could you advice how to solve this issue? how should rqlite and kotsadm deployments should look like?  
thank you,  
Rafał

---

<div class="post-metadata">

**Author:** ![craig](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@craig](https://community.replicated.com/u/craig)\
**Post date:** [December 11, 2023, 8:10pm UTC](https://community.replicated.com/t/read-only-root-file-system/1331/2 "2023-12-11T20:10:31Z")

</div>

Hi @rosmolak,

The following is both the Pod and Container security contexts, respectively, that are applied to all KOTS resources (kotsadm, rqlite, and minio) when running [`kots install`](https://docs.replicated.com/reference/kots-cli-install) with the `--strict-security-context` flag.

Pod Security Context:

```auto
      securityContext:
        fsGroup: 1001
        runAsGroup: 1001
        runAsNonRoot: true
        runAsUser: 1001
        seccompProfile:
          type: RuntimeDefault
        supplementalGroups:
        - 1001

```

Container Security Context:

```auto
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true

```

The following Kubernetes docs indicate where these fields are specified: [Configure a Security Context for a Pod or Container | Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/security-context).

---

<div class="post-metadata">

**Author:** ![craig](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@craig](https://community.replicated.com/u/craig)\
**Post date:** [December 11, 2023, 8:13pm UTC](https://community.replicated.com/t/read-only-root-file-system/1331/3 "2023-12-11T20:13:26Z")

</div>

@rosmolak, I also have a follow up question. You mentioned:

> i generated manifest as KOTS install was not working directly

Could you elaborate more about why the direct KOTS install failed? Were you using the `--strict-security-context` flag?