From 6d587f7b8b9ee1af685eb558ae416ce4d5aac8b9 Mon Sep 17 00:00:00 2001
From: hshankar31 <ext-hariharan.shankar@datastax.com>
Date: Mon, 31 Aug 2026 20:08:07 +0530
Subject: [PATCH] [fix][docker] Fix root permissions after copying /pulsar
 again

---
 docker/pulsar/Dockerfile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docker/pulsar/Dockerfile b/docker/pulsar/Dockerfile
index 1d81239f48860..1e000e07716ce 100644
--- a/docker/pulsar/Dockerfile
+++ b/docker/pulsar/Dockerfile
@@ -122,6 +122,12 @@ ENV PULSAR_ROOT_LOGGER=INFO,CONSOLE
 
 COPY --from=pulsar /pulsar /pulsar
 
+# COPY --from resets the destination directory owner to root:root regardless of
+# what was set in the source stage. Re-apply ownership here so that uid 10000
+# can write directly into /pulsar (e.g. token-superuser-stripped.jwt written by
+# the Helm chart startup script when enableTokenAuth=true).
+RUN chown 10000:0 /pulsar
+
 WORKDIR /pulsar
 ENV PATH=$PATH:$JAVA_HOME/bin:/pulsar/bin