We are currently using a disk-based approach to Kustomize, which has additional file permission problems when running in a container. We can easily switch to using an in-memory filesystem with filesys.MakeEmptyDirInMem(), which has the exact same interface.