How to fix Initdb: could not create directory: Permission denied in PostgreSQL

First, identify what user owns the data directory and what permissions are set:

ls -ld /var/lib/postgresql/data

The output should show the directory is owned by the postgres user. If it shows root or another user, you need to change ownership.

Change the owner of the data directory and all its contents to the postgres user:

sudo chown -R postgres:postgres /var/lib/postgresql/data

If the directory does not exist yet, create it as root first:

sudo mkdir -p /var/lib/postgresql/data
sudo chown postgres:postgres /var/lib/postgresql/data

The data directory must be readable and writable only by the postgres user for security. Set permissions to 0700:

sudo chmod 700 /var/lib/postgresql/data

Verify the permissions are correct:

ls -ld /var/lib/postgresql/data
# Should show: drwx------ postgres postgres

If the parent directory (e.g., /var/lib/postgresql) is root-owned, ensure the postgres user can access it:

sudo chmod 755 /var/lib/postgresql

The parent directory must be readable and executable by the postgres user to access subdirectories, but does not need to be writable.

Execute initdb with the postgres user, not as root. Switch to the postgres user first:

su - postgres

Then run initdb with the correct data directory path:

initdb -D /var/lib/postgresql/data --locale=en_US.UTF-8

Alternatively, use sudo with the -u flag:

sudo -u postgres initdb -D /var/lib/postgresql/data --locale=en_US.UTF-8

Docker permission issues often occur with bind mounts. Use named volumes instead for better permission handling:

services:
  postgres:
    image: postgres:15
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: password

volumes:
  postgres_data:

If you must use bind mounts, ensure correct ownership on the host:

mkdir -p /path/to/pgdata
chown -R 999:999 /path/to/pgdata
chmod 700 /path/to/pgdata

Then mount it with:

volumes:
  - /path/to/pgdata:/var/lib/postgresql/data

When using Kubernetes with persistent volumes (especially NFS), ensure the pod's user ID (typically 999 for postgres container) has read/write access:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: postgres-pv
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  nfs:
    server: nfs-server.example.com
    path: "/exports/postgres"
    # For NFS, ensure export permissions allow the pod UID

On the NFS server, configure the export to allow the postgres UID:

# /etc/exports
/exports/postgres *(rw,no_root_squash,anonuid=999,anongid=999)