Billionmail/BillionMail · critical

failed to create temporary container: %w

Error message

failed to create temporary container: %w

What it means

ExecHostCommand runs a command on the host by creating a privileged temporary alpine container with the host root bind-mounted at /host_root (dockerapi.go:260-362). This error wraps any failure from the Docker SDK client.ContainerCreate call, meaning the Docker daemon rejected or could not fulfill the container creation request. It fires only after docker.sock has been confirmed mounted, so the daemon itself was reachable but creation failed.

Source

Thrown at core/internal/service/dockerapi/dockerapi.go:320

				Type:   mount.TypeBind,
				Source: "/",          // Host root directory
				Target: "/host_root", // Mount point in the container
			},
		},
		NetworkMode: "host", // No network needed
	}

	// Create temporary container
	resp, err := d.client.ContainerCreate(
		ctx,
		config,
		hostConfig,
		nil,
		nil,
		"",
	)
	if err != nil {
		return nil, fmt.Errorf("failed to create temporary container: %w", err)
	}
	containerID := resp.ID
	defer d.cleanupContainer(ctx, containerID) // Ensure container is cleaned up

	// Start container
	if err := d.client.ContainerStart(ctx, containerID, container.StartOptions{}); err != nil {
		return nil, fmt.Errorf("failed to start temporary container: %w", err)
	}

	// Wait for container execution to complete
	statusCh, errCh := d.client.ContainerWait(ctx, containerID, container.WaitConditionNotRunning)
	select {
	case err := <-errCh:
		if err != nil {
			return nil, fmt.Errorf("failed waiting for container execution: %w", err)
		}
	case status := <-statusCh:
		result.ExitCode = int(status.StatusCode)

View on GitHub (pinned to fc36c76c05)

Solutions

1. Verify the daemon logs (journalctl -u docker) for the underlying cause returned in the wrapped %w error
2. Ensure the environment permits privileged containers with a bind mount of / and network_mode=host (not rootless Docker)
3. Pre-pull the alpine:latest image manually: docker pull alpine:latest
4. Free disk space / restart the Docker daemon, then retry

Example fix

// before
resp, err := d.client.ContainerCreate(ctx, config, hostConfig, nil, nil, "")
if err != nil {
	return nil, fmt.Errorf("failed to create temporary container: %w", err)
}
// after: surface the daemon message verbatim and log the attempted command
resp, err := d.client.ContainerCreate(ctx, config, hostConfig, nil, nil, "")
if err != nil {
	g.Log().Errorf(ctx, "ContainerCreate cmd=%v: %v", command, err)
	return nil, fmt.Errorf("failed to create temporary container (cmd=%v): %w", command, err)
}

if _, err := os.Stat("/var/run/docker.sock"); err != nil {
	return fmt.Errorf("docker socket unavailable: %w", err)
}
// also verify image present and daemon reachable before creating
if _, err := d.client.Ping(ctx); err != nil {
	return fmt.Errorf("docker daemon unreachable: %w", err)
}

func canRunPrivilegedBinds() bool {
	// rootless docker cannot do privileged + host bind of /
	return os.Geteuid() == 0
}

result, err := docker.ExecHostCommand(ctx, cmd)
if err != nil {
	var derr error
	if errors.As(err, &derr) && strings.Contains(err.Error(), "failed to create temporary container") {
		// inspect docker daemon state / fallback to direct exec
	}
	return err
}

When it happens

Trigger: Calling ExecHostCommand/ExecHostShellCommand (directly or via addNewRules/deleteOldRules for firewall rule updates) when ContainerCreate fails: the alpine:latest image is absent and unpullable, invalid Cmd/Entrypoint combination, bind-mount of '/' rejected, 'host' network mode unavailable (e.g. rootless/swap-none setups), name conflict, or daemon out of disk/resources.

Common situations: Rootless Docker cannot use host network mode or privileged bind mount of /; Docker daemon stopped or restarting; SELinux/AppArmor blocking the /:/host_root bind mount; no internet access to pull alpine:latest on a fresh install; disk full on the daemon host.

Related errors

• failed to start temporary container: %w
• failed to list containers: %w
• failed to create Docker client: %v
• container with name %s not found
• docker.sock not mounted, cannot access Docker API

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/303b34f8633515cc. Report an issue: GitHub.