diff --git a/ocis/pkg/runtime/runtime.go b/ocis/pkg/runtime/runtime.go
index b0980c1f84..bd83771995 100644
--- a/ocis/pkg/runtime/runtime.go
+++ b/ocis/pkg/runtime/runtime.go
@@ -109,7 +109,7 @@ func (r *Runtime) Start() error {
 	r.c.Storage.Log.Pretty = r.c.Log.Pretty
 
 	addServiceToken("settings", supervisor.Add(settings.NewSutureService(globalCtx, r.c.Settings)))
-	addServiceToken("storage-metadata", supervisor.Add(storage.NewStorageMetadata(globalCtx, r.c.Storage)))
+	addServiceToken("storage-metadata", supervisor.Add(storage.NewStorageMetadata(globalCtx)))
 	addServiceToken("accounts", supervisor.Add(accounts.NewSutureService(globalCtx, r.c.Accounts)))
 	addServiceToken("glauth", supervisor.Add(glauth.NewSutureService(globalCtx, r.c.GLAuth)))
 	addServiceToken("idp", supervisor.Add(idp.NewSutureService(globalCtx, r.c.IDP)))
@@ -120,16 +120,16 @@ func (r *Runtime) Start() error {
 	addServiceToken("thumbnails", supervisor.Add(thumbnails.NewSutureService(globalCtx, r.c.Thumbnails)))
 	addServiceToken("web", supervisor.Add(web.NewSutureService(globalCtx, r.c.Web)))
 	addServiceToken("webdav", supervisor.Add(webdav.NewSutureService(globalCtx, r.c.WebDAV)))
-	addServiceToken("storage-frontend", supervisor.Add(storage.NewFrontend(globalCtx, r.c.Storage)))
-	addServiceToken("storage-gateway", supervisor.Add(storage.NewGateway(globalCtx, r.c.Storage)))
-	addServiceToken("storage-users", supervisor.Add(storage.NewUsersProviderService(globalCtx, r.c.Storage)))
-	addServiceToken("storage-groupsprovider", supervisor.Add(storage.NewGroupsProvider(globalCtx, r.c.Storage))) // TODO(refs) panic? are we sending to a nil / closed channel?
-	addServiceToken("storage-authbasic", supervisor.Add(storage.NewAuthBasic(globalCtx, r.c.Storage)))
-	addServiceToken("storage-authbearer", supervisor.Add(storage.NewAuthBearer(globalCtx, r.c.Storage)))
-	addServiceToken("storage-home", supervisor.Add(storage.NewStorageHome(globalCtx, r.c.Storage)))
-	addServiceToken("storage-users", supervisor.Add(storage.NewStorageUsers(globalCtx, r.c.Storage)))
-	addServiceToken("storage-public-link", supervisor.Add(storage.NewStoragePublicLink(globalCtx, r.c.Storage)))
-	addServiceToken("storage-sharing", supervisor.Add(storage.NewSharing(globalCtx, r.c.Storage)))
+	addServiceToken("storage-frontend", supervisor.Add(storage.NewFrontend(globalCtx)))
+	addServiceToken("storage-gateway", supervisor.Add(storage.NewGateway(globalCtx)))
+	addServiceToken("storage-users", supervisor.Add(storage.NewUsersProviderService(globalCtx)))
+	addServiceToken("storage-groupsprovider", supervisor.Add(storage.NewGroupsProvider(globalCtx))) // TODO(refs) panic? are we sending to a nil / closed channel?
+	addServiceToken("storage-authbasic", supervisor.Add(storage.NewAuthBasic(globalCtx)))
+	addServiceToken("storage-authbearer", supervisor.Add(storage.NewAuthBearer(globalCtx)))
+	addServiceToken("storage-home", supervisor.Add(storage.NewStorageHome(globalCtx)))
+	addServiceToken("storage-users", supervisor.Add(storage.NewStorageUsers(globalCtx)))
+	addServiceToken("storage-public-link", supervisor.Add(storage.NewStoragePublicLink(globalCtx)))
+	addServiceToken("storage-sharing", supervisor.Add(storage.NewSharing(globalCtx)))
 
 	// TODO(refs) debug line with supervised services.
 	go supervisor.ServeBackground()
diff --git a/storage/pkg/command/authbasic.go b/storage/pkg/command/authbasic.go
index bcd05f5d45..8a797a4d93 100644
--- a/storage/pkg/command/authbasic.go
+++ b/storage/pkg/command/authbasic.go
@@ -70,7 +70,7 @@ func AuthBasic(cfg *config.Config) *cli.Command {
 
 			// precreate folders
 			if cfg.Reva.AuthProvider.Driver == "json" && cfg.Reva.AuthProvider.JSON != "" {
-				if err := os.MkdirAll(filepath.Dir(cfg.Reva.AuthProvider.JSON), os.ModeExclusive); err != nil {
+				if err := os.MkdirAll(filepath.Dir(cfg.Reva.AuthProvider.JSON), os.FileMode(0700)); err != nil {
 					return err
 				}
 			}
@@ -208,8 +208,9 @@ type AuthBasicSutureService struct {
 }
 
 // NewAuthBasicSutureService creates a new store.AuthBasicSutureService
-func NewAuthBasic(ctx context.Context, cfg *config.Config) AuthBasicSutureService {
+func NewAuthBasic(ctx context.Context) AuthBasicSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return AuthBasicSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/authbearer.go b/storage/pkg/command/authbearer.go
index 2398892cbc..35a37c1b43 100644
--- a/storage/pkg/command/authbearer.go
+++ b/storage/pkg/command/authbearer.go
@@ -188,8 +188,9 @@ type AuthBearerSutureService struct {
 }
 
 // NewAuthBearerSutureService creates a new gateway.AuthBearerSutureService
-func NewAuthBearer(ctx context.Context, cfg *config.Config) AuthBearerSutureService {
+func NewAuthBearer(ctx context.Context) AuthBearerSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return AuthBearerSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/frontend.go b/storage/pkg/command/frontend.go
index b07634ffed..f15cd2ccfd 100644
--- a/storage/pkg/command/frontend.go
+++ b/storage/pkg/command/frontend.go
@@ -336,8 +336,9 @@ type FrontendSutureService struct {
 }
 
 // NewFrontendSutureService creates a new frontend.FrontendSutureService
-func NewFrontend(ctx context.Context, cfg *config.Config) FrontendSutureService {
+func NewFrontend(ctx context.Context) FrontendSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return FrontendSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/gateway.go b/storage/pkg/command/gateway.go
index 93fb2e76a0..1e996613a4 100644
--- a/storage/pkg/command/gateway.go
+++ b/storage/pkg/command/gateway.go
@@ -265,8 +265,9 @@ type GatewaySutureService struct {
 }
 
 // NewGatewaySutureService creates a new gateway.GatewaySutureService
-func NewGateway(ctx context.Context, cfg *config.Config) GatewaySutureService {
+func NewGateway(ctx context.Context) GatewaySutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return GatewaySutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/groups.go b/storage/pkg/command/groups.go
index 283634e2bf..e4998d33e3 100644
--- a/storage/pkg/command/groups.go
+++ b/storage/pkg/command/groups.go
@@ -70,7 +70,7 @@ func Groups(cfg *config.Config) *cli.Command {
 
 			// precreate folders
 			if cfg.Reva.Groups.Driver == "json" && cfg.Reva.Groups.JSON != "" {
-				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Groups.JSON), os.ModeExclusive); err != nil {
+				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Groups.JSON), os.FileMode(0700)); err != nil {
 					return err
 				}
 			}
@@ -222,8 +222,9 @@ type GroupsProvider struct {
 }
 
 // NewGroupsProvider creates a new storage.GroupsProvider
-func NewGroupsProvider(ctx context.Context, cfg *config.Config) GroupsProvider {
+func NewGroupsProvider(ctx context.Context) GroupsProvider {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return GroupsProvider{
 		ctx:    sctx,
diff --git a/storage/pkg/command/sharing.go b/storage/pkg/command/sharing.go
index 6eb4becb08..1d78c5dbd3 100644
--- a/storage/pkg/command/sharing.go
+++ b/storage/pkg/command/sharing.go
@@ -70,12 +70,12 @@ func Sharing(cfg *config.Config) *cli.Command {
 
 			// precreate folders
 			if cfg.Reva.Sharing.UserDriver == "json" && cfg.Reva.Sharing.UserJSONFile != "" {
-				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Sharing.UserJSONFile), os.ModeExclusive); err != nil {
+				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Sharing.UserJSONFile), os.FileMode(0700)); err != nil {
 					return err
 				}
 			}
 			if cfg.Reva.Sharing.PublicDriver == "json" && cfg.Reva.Sharing.PublicJSONFile != "" {
-				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Sharing.PublicJSONFile), os.ModeExclusive); err != nil {
+				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Sharing.PublicJSONFile), os.FileMode(0700)); err != nil {
 					return err
 				}
 			}
@@ -211,8 +211,9 @@ type SharingSutureService struct {
 }
 
 // NewSharingSutureService creates a new store.SharingSutureService
-func NewSharing(ctx context.Context, cfg *config.Config) SharingSutureService {
+func NewSharing(ctx context.Context) SharingSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return SharingSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/storagehome.go b/storage/pkg/command/storagehome.go
index 97ea560923..02333e712f 100644
--- a/storage/pkg/command/storagehome.go
+++ b/storage/pkg/command/storagehome.go
@@ -207,8 +207,9 @@ type StorageHomeSutureService struct {
 }
 
 // NewStorageHomeSutureService creates a new storage.StorageHomeSutureService
-func NewStorageHome(ctx context.Context, cfg *config.Config) StorageHomeSutureService {
+func NewStorageHome(ctx context.Context) StorageHomeSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return StorageHomeSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/storagemetadata.go b/storage/pkg/command/storagemetadata.go
index ff258482ea..3c1589ddab 100644
--- a/storage/pkg/command/storagemetadata.go
+++ b/storage/pkg/command/storagemetadata.go
@@ -228,8 +228,9 @@ type SutureService struct {
 }
 
 // NewSutureService creates a new storagemetadata.SutureService
-func NewStorageMetadata(ctx context.Context, cfg *config.Config) SutureService {
+func NewStorageMetadata(ctx context.Context) SutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return SutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/storagepubliclink.go b/storage/pkg/command/storagepubliclink.go
index 8b17da98eb..f2c3febd1f 100644
--- a/storage/pkg/command/storagepubliclink.go
+++ b/storage/pkg/command/storagepubliclink.go
@@ -185,8 +185,9 @@ type StoragePublicLinkSutureService struct {
 }
 
 // NewStoragePublicLinkSutureService creates a new storage.StoragePublicLinkSutureService
-func NewStoragePublicLink(ctx context.Context, cfg *config.Config) StoragePublicLinkSutureService {
+func NewStoragePublicLink(ctx context.Context) StoragePublicLinkSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return StoragePublicLinkSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/storageusers.go b/storage/pkg/command/storageusers.go
index cf4603690d..c0daccb3e0 100644
--- a/storage/pkg/command/storageusers.go
+++ b/storage/pkg/command/storageusers.go
@@ -207,8 +207,9 @@ type StorageUsersSutureService struct {
 }
 
 // NewStorageUsersSutureService creates a new storage.StorageUsersSutureService
-func NewStorageUsers(ctx context.Context, cfg *config.Config) StorageUsersSutureService {
+func NewStorageUsers(ctx context.Context) StorageUsersSutureService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return StorageUsersSutureService{
 		ctx:    sctx,
diff --git a/storage/pkg/command/users.go b/storage/pkg/command/users.go
index 801a9e1c6f..59edaedcfe 100644
--- a/storage/pkg/command/users.go
+++ b/storage/pkg/command/users.go
@@ -70,7 +70,7 @@ func Users(cfg *config.Config) *cli.Command {
 
 			// precreate folders
 			if cfg.Reva.Users.Driver == "json" && cfg.Reva.Users.JSON != "" {
-				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Users.JSON), os.ModeExclusive); err != nil {
+				if err := os.MkdirAll(filepath.Dir(cfg.Reva.Users.JSON), os.FileMode(0700)); err != nil {
 					return err
 				}
 			}
@@ -223,8 +223,9 @@ type UsersProviderService struct {
 }
 
 // NewUsersProviderService creates a new storage.UsersProviderService
-func NewUsersProviderService(ctx context.Context, cfg *config.Config) UsersProviderService {
+func NewUsersProviderService(ctx context.Context) UsersProviderService {
 	sctx, cancel := context.WithCancel(ctx)
+	cfg := config.New()
 	cfg.Context = sctx
 	return UsersProviderService{
 		ctx:    sctx,