# Deployment on openshift

**URL:** <https://forum.inductiveautomation.com/t/deployment-on-openshift/106559>\
**Category:** Ignition\
**Created:** [May 22, 2025, 1:20pm UTC](https://forum.inductiveautomation.com/t/deployment-on-openshift/106559 "2025-05-22T13:20:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pdeswert](https://avatars.discourse-cdn.com/v4/letter/p/a8b319/32.png) [@Pdeswert](https://forum.inductiveautomation.com/u/Pdeswert)\
**Post date:** [May 22, 2025, 1:20pm UTC](https://forum.inductiveautomation.com/t/deployment-on-openshift/106559/1 "2025-05-22T13:20:54Z")

</div>

Hi there

We are having issues getting ignition on the openshift platform, the image keeps crashing due to permissions denied, I have followed the examples from the image documentation

init | 2025/05/22 13:14:34 | WARNING: IGNITION\_UID='2003' and IGNITION\_GID='2003' are ignored when not running as root (uid=0), detected uid=1000790000  
init | 2025/05/22 13:14:34 | Creating init.properties file  
init | 2025/05/22 13:14:34 | Creating gateway.xml  
cp: cannot create regular file '/usr/local/bin/ignition/data/gateway.xml': Permission denied

I also tried building an image with heightened read/writes rights to the folders but that is not working

Can someone provide me with a clear explanation on how to fix this ?

---

<div class="post-metadata">

**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\
**Post date:** [May 22, 2025, 1:56pm UTC](https://forum.inductiveautomation.com/t/deployment-on-openshift/106559/2 "2025-05-22T13:56:20Z")

</div>

The default SCC (Security Context Constraint) on OpenShift is `restricted`, which enforces randomized UID/GID assignments (such as the `1000790000` mentioned in your logs). This breaks the current filesystem permissions in our image. We've got a ticket to fix this up, however...

...the options at this time are:

1. Create/use a service account with an association to the `nonroot` security context. This will allow Ignition to run as UID/GID `2003` (the default in our image). [This guide](https://cookbook.openshift.org/users-and-role-based-access-control/how-can-i-enable-an-image-to-run-as-a-set-user-id.html) will be helpful.
2. Build a derived image that changes the Ignition installation to have `root` group ownership (and `root` group write access) of the installation files (OpenShift leverages this to facilitate r/w via adding the dynamic UID to the `root` group).

If you go with option 2, this `Dockerfile` should get you going (consider squashing the image afterwards, as this operation will add a large layer due to the permission changes):

```python
FROM inductiveautomation/ignition:8.1.48

USER root

RUN chgrp -R 0 /usr/local/bin/ignition /home/ignition && \
    chmod -R g=u /usr/local/bin/ignition /home/ignition

ENV HOME=/home/ignition

USER 2003:2003

```

---

<div class="post-metadata">

**Author:** ![Pdeswert](https://avatars.discourse-cdn.com/v4/letter/p/a8b319/32.png) [@Pdeswert](https://forum.inductiveautomation.com/u/Pdeswert)\
**Post date:** [May 23, 2025, 7:11am UTC](https://forum.inductiveautomation.com/t/deployment-on-openshift/106559/3 "2025-05-23T07:11:59Z")

</div>

that did the trick, thanks