# /usr/local/bin/docker-entrypoint: line 8: /usr/share/heartbeat/heartbeat: Operation not permitted

**URL:** <https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119>\
**Category:** Beats\
**Tags:** docker, heartbeat\
**Created:** [April 10, 2024, 8:21am UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119 "2024-04-10T08:21:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![WookWook](https://avatars.discourse-cdn.com/v4/letter/w/54ee81/32.png) [@WookWook](https://discuss.elastic.co/u/WookWook)\
**Post date:** [April 10, 2024, 8:21am UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119/1 "2024-04-10T08:21:36Z")

</div>

Hi,

we are are running Elastic Cloud on Kubernetes 2.11 in an Openshift 4.12 environment. All images use version 8.12.1

I am having issues to get heatbeat running. I followed the Elastic Docs

> **[Grant privileged permissions to Beats | Elastic Cloud on Kubernetes \[2.12\] |...](https://www.elastic.co/guide/en/cloud-on-k8s/2.12/k8s-openshift-beats.html)**

Created a service account. Changed the scc policy to privileged. Added the heartbeat config part to my eck yaml.

After rolling it out, the heartbeat pod keeps failing with the following errror message.

```auto
/usr/local/bin/docker-entrypoint: line 8: /usr/share/heartbeat/heartbeat: Operation not permitted

```

What do I miss?

Regards,  
Marius

---

<div class="post-metadata">

**Author:** ![emilioalvap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emilioalvap/32/99310_2.png) [@emilioalvap](https://discuss.elastic.co/u/emilioalvap)\
**Post date:** [April 12, 2024, 9:52am UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119/2 "2024-04-12T09:52:47Z")

</div>

Hi @WookWook,

It's likely the container is running with insufficient permissions to run heartbeat executable. Are you using openshift's dynamic uid? Please make sure the container is running with `fsGroup: 0` and `supplementalGroups: [0]`.

Hope that helps!

---

<div class="post-metadata">

**Author:** ![kyocoolcool](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kyocoolcool/32/134861_2.png) [@kyocoolcool](https://discuss.elastic.co/u/kyocoolcool)\
**Post date:** [May 28, 2024, 8:50am UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119/3 "2024-05-28T08:50:59Z")

</div>

I try to add `fsGroup: 0` and `supplementalGroups: [0]`, this error still occurs:  
/usr/local/bin/docker-entrypoint: line 8: /usr/share/heartbeat/heartbeat: Operation not permitted

Here is my yaml file:

```auto
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat 
metadata:  
  name: heartbeat
spec:      
  type: heartbeat
  version: 8.13.4
  elasticsearchRef:
    name: elasticsearch-sample
  config:  
    heartbeat.monitors:
    - type: tcp
      schedule: '@every 5s'
      hosts: ["elasticsearch-sample-es-http:9200"]
    - type: tcp
      schedule: '@every 5s'
      hosts: ["kibana-sample-kb-http:5601"]
  deployment:
    replicas: 1
    podTemplate:
      spec:
        serviceAccountName: heartbeat
        securityContext:
          runAsUser: 0
          fsGroup: 0
          supplementalGroups: [0]

```

---

<div class="post-metadata">

**Author:** ![WookWook](https://avatars.discourse-cdn.com/v4/letter/w/54ee81/32.png) [@WookWook](https://discuss.elastic.co/u/WookWook)\
**Post date:** [May 28, 2024, 2:30pm UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-usr-share-heartbeat-heartbeat-operation-not-permitted/357119/4 "2024-05-28T14:30:54Z")

</div>

Sorry for the late reply. My working configuration looks as follows

```auto
  deployment:
    replicas: 1
    podTemplate:
      spec:
        containers:
        - name: heartbeat
          securityContext:
            capabilities:
              add: ["NET_RAW", "SYS_CHROOT"]
        serviceAccountName: heartbeat
        securityContext:
          runAsUser: 0
        volumes:
          - name: beat-data
            emptyDir: {}

```