2026-07-30 00:11:16 +10:00
1 changed files with 5 additions and 0 deletions
@@ -59,6 +59,11 @@ spec:
      containers:
        - name: nats-bootstrap
          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0
+          # nats CLI stats the working directory when loading its response
+          # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's
+          # default WORKDIR is not accessible ("stat .: permission denied"), so
+          # run from the writable /tmp emptyDir.
+          workingDir: /tmp
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true