From 754cd72df56e58c356e742491c470eb5ad2e0333 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 26 Apr 2026 01:43:37 -0500
Subject: [PATCH] Fix SQLite READONLY: chown /data to UID 1000 via
 initContainer

PVC was written as root before runAsUser: 1000 was added; SQLite
refused writes with SQLITE_READONLY. initContainer runs as root to
chown the volume, then the app runs as UID 1000 as required.
---
 .../k8s/neuron-technologies/prod/mcp-deployment.yaml   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
index afe3760..5190aae 100644
--- a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
@@ -28,6 +28,16 @@ spec:
         runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: fix-data-ownership
+          image: busybox:1.36
+          command: ["sh", "-c", "chown -R 1000:1000 /data"]
+          securityContext:
+            runAsUser: 0
+            runAsNonRoot: false
+          volumeMounts:
+            - name: data
+              mountPath: /data
       containers:
         - name: neuron-mcp
           image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.15.3