# Enabling Encryption in Docker Container with Root Owned Encryption Key File

**URL:** <https://forums.percona.com/t/enabling-encryption-in-docker-container-with-root-owned-encryption-key-file/25522>\
**Category:** Percona Server for MongoDB\
**Tags:** closed-no-reply\
**Created:** [September 28, 2023, 3:16pm UTC](https://forums.percona.com/t/enabling-encryption-in-docker-container-with-root-owned-encryption-key-file/25522 "2023-09-28T15:16:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![boulder\_pika1](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@boulder\_pika1](https://forums.percona.com/u/boulder_pika1)\
**Post date:** [September 28, 2023, 3:16pm UTC](https://forums.percona.com/t/enabling-encryption-in-docker-container-with-root-owned-encryption-key-file/25522/1 "2023-09-28T15:16:18Z")

</div>

Greetings -

I am trying to run the docker Percona Server for MongoDB with at-rest encryption enabled with a local key file as follows:  
**docker run --rm --name percona --user root:root -v ./datadir:/data/db -v ./percona\_key:/tmp/percona\_key percona/percona-server-mongodb:6.0 --enableEncryption --encryptionKeyFile /tmp/percona\_key**

For security reasons, I want my encryptionKeyFile to be owned by root:  
_ls -l percona\_key_  
**-rw------- 1 root root 45 Sep 28 08:02 percona\_key**

However, this seems to cause the container grief as I see this error message in the log:  
**Data-at-Rest Encryption Error",“attr”:{“error”:{“what”:“Can’t create encryption key database”,“reason”:{“what”:“key reading failed”,“reason”:“reading the master key from the encryption key file failed: cannot open specified encryption key file: /tmp/percona\_key”},“encryptionKeyDatabaseDirectory”:"/data/db/key.db**

If I were to run the container without encryption, I am indeed able execute a shell in the container and cat the contents of /tmp/percona\_key successfully:  
_docker run --rm --name percona --user root:root -v ./datadir:/data/db -v ./percona\_key:/tmp/percona\_key percona/percona-server-mongodb:6.0_  
_docker exec -i percona cat /tmp/percona\_key_  
**xIaMJL26yLFZR6gES3mPTf5GZX7EStQ+qXbh9hDk6GA=**

So, is it possible to have root own the key file with the container and if so how?