# fsGroupChangePolicy: OnRootMismatch and the setgid Invariant That Makes It Sound

DevFeed: [fsGroupChangePolicy: OnRootMismatch and the setgid Invariant That Makes It Sound](<https://devfeed.tech/articles/fsgroupchangepolicy-onrootmismatch-and-the-setgid-invariant-that-makes-it-sound-34103.md>)

Original publisher: [Read original article](<https://philipptheserver.com/posts/fsgroup-change-policy-root-mismatch/>)

Author: Philipp Lehmann (philipp.lehmann@gruppe.ai)

Published: 2026-09-11T07:00:00Z

Content type: tutorial

Language: en

Sources: [Philipp Lehmann](<https://devfeed.tech/sources/philipp-lehmann.md>)

Topics: [container](<https://devfeed.tech/topics/container.md>), [mount](<https://devfeed.tech/topics/mount.md>), [Security](<https://devfeed.tech/topics/security.md>), [Process](<https://devfeed.tech/topics/process.md>)

Tags: [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [mount](<https://devfeed.tech/tags/mount.md>), [network](<https://devfeed.tech/tags/network.md>), [performance](<https://devfeed.tech/tags/performance.md>), [reliability](<https://devfeed.tech/tags/reliability.md>), [security](<https://devfeed.tech/tags/security.md>), [stateful](<https://devfeed.tech/tags/stateful.md>), [storage](<https://devfeed.tech/tags/storage.md>), [waiting](<https://devfeed.tech/tags/waiting.md>)

## AI overview

This article explains why a stateful pod can remain in ContainerCreating for fifteen minutes when fsGroup triggers a recursive chown across a large network-backed volume. It describes how fsGroupChangePolicy: OnRootMismatch can skip the recursive walk when the volume root group already matches, and discusses the setgid invariant that supports this behavior.

## Source excerpt

Pod stuck in ContainerCreating from fsGroup recursive chown: fsGroupChangePolicy: OnRootMismatch, and why the setgid bit on the volume root makes it safe.