chown("/var/cache/nginx/client_temp", 101) failed (1: Operation not permitted)

[Auroch]

Describe the bug

I'm trying to launch this container in a homelab kubernetes cluster, but the pod startup ends with:

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf differs from the packaged version
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2025/01/26 06:34:01 [emerg] 1#1: chown("/var/cache/nginx/client_temp", 101) failed (1: Operation not permitted)
nginx: [emerg] chown("/var/cache/nginx/client_temp", 101) failed (1: Operation not permitted)
stream closed EOF for it-tools/it-tools-6ff7c8758c-wmnsj (it-tools)

I'm just starting out, so it's possible I'm making an error on my end, but in any case, I can't find the solution. I'm on a Talos-based Kubernetes cluster and here's the deployment I'm trying to set up:

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: it-tools
  name: it-tools
  namespace: it-tools
spec:
  replicas: 1
  selector:
    matchLabels:
      app: it-tools
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: it-tools
    spec:
      nodeSelector:
        kubernetes.io/role: worker
      containers:
      - image: ghcr.io/corentinth/it-tools:latest
        name: it-tools
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - name: nginx-cache
          mountPath: /var/cache/nginx
      volumes:
      - name: nginx-cache
        emptyDir: {}
status: {}
``

### What happened?

A bug happened!

### System information

Talos: 1.9.1

Kubernetes:
 - Client Version: v1.31.4
 - Kustomize Version: v5.4.2
 - Server Version: v1.32.

### Where did you encounter the bug?

Other (installations, docker, etc.)

[sharevb]

Hi @Auroch, may be related to #1134