{"record":{"id":"17f70be877c59960","repo":"coleam00/Archon","slug":"could-not-mount-the-overlay-in-any-mode-native-ov","errorCode":null,"errorMessage":"Could not mount the overlay in any mode. Native overlay needs CAP_SYS_ADMIN; fuse-overlayfs needs /dev/fuse AND an unprivileged-mount daemon (rootless / userns-remap). Attempts:\\n${failures.join('\\n')}","messagePattern":"Could not mount the overlay in any mode\\. Native overlay needs CAP_SYS_ADMIN; fuse-overlayfs needs /dev/fuse AND an unprivileged-mount daemon \\(rootless / userns-remap\\)\\. Attempts:\\\\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/isolation/src/backends/container.ts","lineNumber":594,"sourceCode":"      try {\n        await this.waitForReady(containerId);\n        if (mode !== OVERLAY_MODES[0]) {\n          log.warn({ containerName, mode }, 'isolation.container_overlay_fallback');\n        }\n        return { containerId, mode };\n      } catch (readyErr) {\n        // Container started but the mount failed (entrypoint exits fast) — remove\n        // it so the name is free for the next mode, then continue.\n        failures.push(`${mode}: ${(readyErr as Error).message}`);\n        await this.docker(['rm', '-f', containerName]).catch(rmErr => {\n          log.warn(\n            { containerName, mode, detail: extractDockerError(rmErr) },\n            'isolation.container_fallback_cleanup_failed'\n          );\n        });\n      }\n    }\n    throw new Error(\n      'Could not mount the overlay in any mode. Native overlay needs CAP_SYS_ADMIN; ' +\n        'fuse-overlayfs needs /dev/fuse AND an unprivileged-mount daemon ' +\n        `(rootless / userns-remap). Attempts:\\n${failures.join('\\n')}`\n    );\n  }\n\n  /**\n   * `docker run -d` the runner image in the given overlay mode. `fuse` grants\n   * only `--device /dev/fuse` (no CAP_SYS_ADMIN); `native` grants\n   * `--cap-add SYS_ADMIN --security-opt apparmor=unconfined` (no device). The\n   * entrypoint mounts per `ARCHON_OVERLAY_MODE`.\n   *\n   * @returns the full container id from `docker run`'s stdout.\n   */\n  private async runContainerInMode(\n    containerName: string,\n    volume: string,\n    hostRoot: string,","sourceCodeStart":576,"sourceCodeEnd":612,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/isolation/src/backends/container.ts#L576-L612","documentation":"startContainerWithOverlay tries mounting the overlay filesystem inside the runner container in several modes (native overlayfs, then fuse-overlayfs). If every mode fails, it throws this aggregate error listing each attempt's failure detail.","triggerScenarios":"prepare()/resume start a container where native overlay lacks CAP_SYS_ADMIN and fuse-overlayfs lacks /dev/fuse or the unprivileged-mount daemon (rootless/userns-remap Docker).","commonSituations":"Rootless Docker without /dev/fuse exposed; userns-remap daemon blocking privileged mounts; hardened hosts (gVisor/Kata) not implementing overlayfs; restricted container runtime capabilities.","solutions":["Run Docker as root (non-rootless) or enable CAP_SYS_ADMIN on the runner container","Expose /dev/fuse to the container and install fuse-overlayfs in the runner image","If rootless, ensure the rootless daemon supports unprivileged overlay mounts (kernel >= 5.11 with fuse-overlayfs configured)","Fall back to a non-overlay isolation backend if the host cannot support either mode"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// best-effort: check capabilities before attempting overlay\nconst caps = process.env.DOCKER_HOST?.includes('rootless') || process.env.USERNS_REMAP\n  ? 'rootless'\n  : 'rootful';\nif (caps === 'rootless') console.warn('overlay may need fuse-overlayfs + /dev/fuse');","typeGuard":null,"tryCatchPattern":"try {\n  await backend.prepare(opts);\n} catch (err) {\n  if (String(err).startsWith('Could not mount the overlay in any mode')) {\n    // inspect err message 'Attempts:' section; switch backend or fix host capabilities\n  }\n  throw err;\n}","preventionTips":["Pre-install fuse-overlayfs and expose /dev/fuse when using rootless Docker","Avoid userns-remap/gVisor runtimes where overlay mounts are unsupported","Test overlay mode once on each host image before batch runs"],"tags":["docker","overlayfs","fuse","permissions"],"backgroundTag":"overlay-mount-unsupported","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}