# Pod Security Context

**URL:** <https://discourse.jupyter.org/t/pod-security-context/1965>\
**Category:** Zero to JupyterHub on Kubernetes\
**Created:** [August 22, 2019, 8:15am UTC](https://discourse.jupyter.org/t/pod-security-context/1965 "2019-08-22T08:15:24Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)\
**Post date:** [August 23, 2019, 1:52pm UTC](https://discourse.jupyter.org/t/pod-security-context/1965/4 "2019-08-23T13:52:56Z")

</div>

If you’re using an image based on the [standard Jupyter docker stacks](https://github.com/jupyter/docker-stacks) you can start them as root, pass in the UID as an environment variable, and the jupyter user will then have access to their external NFS shares. See this example which uses LDAP, though you can use any authenticator that returns you the UID, the most relevant bit is the `pre_spawn_start` method:

> [@Starting single-user notebook with our custom ldap docker image](https://discourse.jupyter.org/t/starting-single-user-notebook-with-our-custom-ldap-docker-image/881/4):
>
> I’ve done this before. It requires [this change to the LDAPAuthenticator](https://github.com/jupyterhub/ldapauthenticator/pull/103). You can then configure JupyterHub to extract the required LDAP attributes (username, UID), and pass them to the singleuser server by setting appropriate environment variables. If you start the singleuser server as root it will switch to that UID, which means it should be able to write to NFS as that user. I’ve written up some brief instructions:

---

_[View the full topic](https://discourse.jupyter.org/t/pod-security-context/1965)._