A fresh tws_settings PVC mounts root-owned; the gnzsnz container runs as the non-root ibgateway user (UID/GID 1000) -> "Permission denied" writing jts.ini -> crashloop. fsGroup: 1000 makes the volume group-writable. Verified: new pod ready, 0 restarts, "IBC: Login has completed". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>