# Elastic-agent-complete:\>=8.16.0 chowns NSSDB

**URL:** <https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556>\
**Category:** Elastic Agent\
**Created:** [December 5, 2024, 4:58pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556 "2024-12-05T16:58:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [December 5, 2024, 4:58pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556/1 "2024-12-05T16:58:26Z")

</div>

I am having an issue with `elastic-agent-complete:8.16.1`.

We use self-signed certs on many of the internal sites we monitor, so I have to add these certs to the nssdb, however they need to be chown'd to `elastic-agent:elastic-agent` for them to be used by the browser agent. This worked well for `elastic-agent-complete:<8.16.0`. However, starting with `8.16.0`, elastic-agent appears to chown everything in `/usr/share/elastic-agent` to `root:root` on startup, which breaks the certs in the nssdb (I'm running as `root:root`). In this particular situation, I don't have the option to build the certs and nssdb into the image, so I need to run as `root:root` in order to update the image cert store.

Suggestions?

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [December 5, 2024, 7:10pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556/2 "2024-12-05T19:10:44Z")

</div>

# Update

When I build my updated cert store and appropriately chown everything in an initContainer, then run my agent as elastic-agent, it won't start because it can't write the agent.lock file.

If I stand up a new instance that has NEVER run as root, I get the error that the agent is not able to create `/usr/share/elastic-agent/state/data`.

The ONLY thing I haven't tried to resolve this so far is to mount the `agent-data` share in my init container and do `chown -R 1000:1000 ...`.

## PS

I'm deploying through the Elastic Operator (ECK) using a `deployment`, if any of this makes a difference.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [January 21, 2025, 3:50pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556/3 "2025-01-21T15:50:45Z")

</div>

Bump

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [January 27, 2025, 8:35pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556/4 "2025-01-27T20:35:12Z")

</div>

# Update #2

I've created a ticket [here](https://github.com/elastic/synthetics/issues/994), which includes a workaround.