os.makedirs(..., mode=0o700, exist_ok=True) only applies the mode when it actually creates the directory; if the directory already exists (e.g. left over from a prior run with a permissive umask) the mode is silently ignored, leaving it group/other-writable and causing verifyConfigPathPermissions() to reject it at mongod startup.