Set Permissions on an emptyDir Volume

Set Permissions on an emptyDir Volume

FEATURE STATE: Kubernetes v1.37 [alpha](disabled by default)

This page shows how to set Unix permission bits on an emptyDir volume directory using the mode field.

Before you begin

You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:

Your Kubernetes server must be version v1.37.

To check the version, enter kubectl version.

You need to have the EmptyDirVolumeMode feature gate enabled on the API server and the kubelet.

Create a Pod that uses an emptyDir volume with custom permissions

The emptyDir.mode field lets you set Unix permission bits (from 0000 to 01777 in octal) on the volume directory. If not specified, the directory is created with the default 0777 permissions.

For example, to create a shared /tmp directory with the sticky bit set so that only file owners can delete their own files:

pods/emptydir-volume-mode.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: emptydir-mode-demo
spec:
  containers:
  - image: registry.k8s.io/busybox
    name: test-container
    command: ["sleep", "3600"]
    volumeMounts:
    - mountPath: /tmp
      name: tmp-volume
  volumes:
  - name: tmp-volume
    emptyDir:
      mode: 01777

  1. Create the pod on your cluster:

    kubectl apply -f https://k8s.io/examples/pods/emptydir-volume-mode.yaml

  2. Verify the pod is running:

    kubectl get pod emptydir-mode-demo

  3. Check the permissions on the mounted volume:

    kubectl exec emptydir-mode-demo -- ls -ld /tmp

    The output is similar to:

    drwxrwxrwt 2 root root 4096 Jul 28 00:00 /tmp

    The t at the end confirms the sticky bit is set.

  4. Delete the Pod that you created for this exercise:

    kubectl delete pod emptydir-mode-demo

What's next

Last modified June 30, 2026 at 3:35 PM PST: Add documentation for KEP-5502: emptyDir volume permission mode (657119c40a)