When using the supported Neo4j Helm Charts to install Neo4j, customer sites may have an additional requirement to ensure the container file system is read-only and runs with a non root user. For example, customers may attempt to add the readOnlyRootFilesystem: true to their containerSecurityContext configuration and run as a non root user of neo4j user 7474.

# securityContext defines privilege and access control settings for a Container. 
containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 7474
  runAsGroup: 7474
  capabilities:
    drop:
    - ALL

When adding this configuration, users may encounter the error below on install startup as seen in the pod logs.

ERROR: /startup/docker-entrypoint.sh: line 260: /var/lib/neo4j/conf/neo4j.conf: Read-only file system

When using the Neo4j Helm Charts to install Neo4j, the startup needs to run as root so that it can re-own mounted folders if needed. In addition, the entrypoint makes file system changes before invoking Neo4j - that is to make extra usability features work.

For instance, the entrypoint can fail when it attempts to copy any conf files in the provided /conf folder to /var/lib/neo4j/conf/. This is done so not to overwrite the user's actual conf file. This is also important as this is how environment variable configuration settings are applied. In addition, if using NEO4J_PLUGINS to download plugins, the same type of issue can occur as the plugins write to /var/lib/neo4j/plugins.
 
When customizing the supported Neo4j Helm Charts , it is suggested to ensure to configure writable mounted volumes for
1.)  /data
2.)  /logs
3.)  /tmp (to prevent JVM errors when starting neo4j due to linux requirement)
4.)  /metrics ( if metrics are enabled as Neo4j enterprise will write metrics into /var/lib/neo4j/metrics)
5.) /plugins ( if using NEO4J_PLUGINS you will need to mount a volume for plugins i.e. /var/lib/neo4j/plugins)

In addition, add any additional volumes and mounts below to satisfy the requirements that the chart does not support in the volumes section. 
6.)  mount volume to /var/lib/neo4j/conf
Example:

 # add additional volumes and their respective mounts
additionalVolumes: 
  - name: neo4j1-conf
    emptyDir: 
      sizeLimit: 10Mi
additionalVolumeMounts: 
  - name: neo4j1-conf
    mountPath: "/var/lib/neo4j/conf"