{"record":{"id":"0769d89f360fe317","repo":"thanos-io/thanos","slug":"create-dir","errorCode":null,"errorMessage":"create dir","messagePattern":"create dir","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/thanos/downsample.go","lineNumber":192,"sourceCode":"\n\tlevel.Info(logger).Log(\"msg\", \"starting downsample node\")\n\treturn nil\n}\n\nfunc downsampleBucket(\n\tctx context.Context,\n\tlogger log.Logger,\n\tmetrics *DownsampleMetrics,\n\tbkt objstore.Bucket,\n\tmetas map[ulid.ULID]*metadata.Meta,\n\tdir string,\n\tdownsampleConcurrency int,\n\tblockFilesConcurrency int,\n\thashFunc metadata.HashFunc,\n\tacceptMalformedIndex bool,\n) (rerr error) {\n\tif err := os.MkdirAll(dir, 0750); err != nil {\n\t\treturn errors.Wrap(err, \"create dir\")\n\t}\n\n\tdefer func() {\n\t\t// Leave the downsample directory for inspection if it is a halt error\n\t\t// or if it is not then so that possibly we would not have to download everything again.\n\t\tif rerr != nil {\n\t\t\treturn\n\t\t}\n\t\tif err := os.RemoveAll(dir); err != nil {\n\t\t\tlevel.Error(logger).Log(\"msg\", \"failed to remove downsample cache directory\", \"path\", dir, \"err\", err)\n\t\t}\n\t}()\n\n\t// mapping from a hash over all source IDs to blocks. We don't need to downsample a block\n\t// if a downsampled version with the same hash already exists.\n\tsources5m := map[ulid.ULID]struct{}{}\n\tsources1h := map[ulid.ULID]struct{}{}\n","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/downsample.go#L174-L210","documentation":"downsampleBucket wraps the error from os.MkdirAll(dir, 0750) with the context \"create dir\". The tool cannot create the local working directory where blocks are downloaded and downsampled before upload. This is an environment-level failure (permissions, path, disk) rather than a logic bug.","triggerScenarios":"os.MkdirAll fails because the parent path is missing and cannot be created, the process lacks write permission on the path (0750 mode), the path exists as a regular file, or the filesystem is read-only/full.","commonSituations":"Running `thanos downsample` with --data-dir pointing at a read-only volume or a path owned by another user; container running as non-root with a host-mounted dir not writable; --data-dir accidentally pointing at a file; NFS/EFS permission issues.","solutions":["Check permissions/ownership on the --data-dir path and chown/chmod it for the thanos process user.","Verify the path does not already exist as a regular file; remove or change --data-dir.","Ensure the parent directory chain exists and the filesystem is writable (not mounted ro, disk not full).","If in a container, mount an emptyDir/PV at the data dir with correct fsGroup/securityContext."],"exampleFix":"// before (systemd unit)\nReadWritePaths=/var/lib/thanos\n// after\nReadWritePaths=/var/lib/thanos\ncd /var/lib && chown thanos:thanos thanos && chmod 750 thanos","handlingStrategy":"validation","validationCode":"info, err := os.Stat(dataDir)\nif err == nil && !info.IsDir() {\n    return fmt.Errorf(\"--data-dir %s exists and is not a directory\", dataDir)\n}\nif err := os.MkdirAll(dataDir, 0750); err != nil {\n    return fmt.Errorf(\"data-dir not usable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-provision the data dir with correct ownership (750) in deployment config/entrypoint.","Add a readiness check or init container that verifies the data dir is writable before starting thanos.","Mount dedicated writable storage for --data-dir; never point it at read-only or shared-with-cleaner volumes."],"tags":["filesystem","permissions","mkdir"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}