# Pod Security Context

**URL:** <https://discourse.jupyter.org/t/pod-security-context/1965>\
**Category:** Zero to JupyterHub on Kubernetes\
**Created:** [August 22, 2019, 8:15am UTC](https://discourse.jupyter.org/t/pod-security-context/1965 "2019-08-22T08:15:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![belfhi](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/belfhi/32/1064_2.png) [@belfhi](https://discourse.jupyter.org/u/belfhi)\
**Post date:** [August 22, 2019, 8:15am UTC](https://discourse.jupyter.org/t/pod-security-context/1965/1 "2019-08-22T08:15:24Z")

</div>

Hello,  
we want to use NFS shares for data of Experiments and access this data from  
within a Container in the z2jh kubernetes deployment.  
Is there currently any way to change the k8s security context so the pod runs as  
a UID that matches the UID from the NFS share?  
Using security policies  
[https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)  
would be a great enhancement to z2jh.

---

<div class="post-metadata">

**Author:** ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)\
**Post date:** [August 22, 2019, 5:21pm UTC](https://discourse.jupyter.org/t/pod-security-context/1965/2 "2019-08-22T17:21:04Z")

</div>

You can set the `uid` and `fsGid`: [https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/2d435d64d4978380f68a1bda185add4376c29272/jupyterhub/values.yaml#L188-L189](https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/2d435d64d4978380f68a1bda185add4376c29272/jupyterhub/values.yaml#L188-L189)

---

<div class="post-metadata">

**Author:** ![belfhi](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/belfhi/32/1064_2.png) [@belfhi](https://discourse.jupyter.org/u/belfhi)\
**Post date:** [August 23, 2019, 7:30am UTC](https://discourse.jupyter.org/t/pod-security-context/1965/3 "2019-08-23T07:30:02Z")

</div>

Hello,  
yes I am aware of that but could I also set it dynamically? So that every user get a pod which runs under their “real” UID? Then we could very easily allow NFS shares…  
cheers,  
johannes

---

<div class="post-metadata">

**Author:** ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)\
**Post date:** [August 23, 2019, 1:52pm UTC](https://discourse.jupyter.org/t/pod-security-context/1965/4 "2019-08-23T13:52:56Z")

</div>

If you’re using an image based on the [standard Jupyter docker stacks](https://github.com/jupyter/docker-stacks) you can start them as root, pass in the UID as an environment variable, and the jupyter user will then have access to their external NFS shares. See this example which uses LDAP, though you can use any authenticator that returns you the UID, the most relevant bit is the `pre_spawn_start` method:

> [@Starting single-user notebook with our custom ldap docker image](https://discourse.jupyter.org/t/starting-single-user-notebook-with-our-custom-ldap-docker-image/881/4):
>
> I’ve done this before. It requires [this change to the LDAPAuthenticator](https://github.com/jupyterhub/ldapauthenticator/pull/103). You can then configure JupyterHub to extract the required LDAP attributes (username, UID), and pass them to the singleuser server by setting appropriate environment variables. If you start the singleuser server as root it will switch to that UID, which means it should be able to write to NFS as that user. I’ve written up some brief instructions: