{"record":{"id":"1a66f4d70a22f84f","repo":"hashicorp/nomad","slug":"failed-to-create-alloc-logs-envoy-bootstrap-stderr","errorCode":null,"errorMessage":"failed to create alloc/logs/envoy_bootstrap.stderr.0 for envoy: %w","messagePattern":"failed to create alloc/logs/envoy_bootstrap\\.stderr\\.0 for envoy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/envoy_bootstrap_hook.go","lineNumber":382,"sourceCode":"\t\tdefault:\n\t\t}\n\n\t\t// Prepare bootstrap command to run.\n\t\tcmd := exec.CommandContext(ctx, \"consul\", bootstrapArgs...)\n\t\tcmd.Env = bootstrapEnv\n\n\t\t// Redirect stdout to secrets/envoy_bootstrap.json.\n\t\tstdout, fileErr := os.Create(bootstrapFilePath)\n\t\tif fileErr != nil {\n\t\t\treturn false, fmt.Errorf(\"failed to create secrets/envoy_bootstrap.json for envoy: %w\", fileErr)\n\t\t}\n\t\tdefer stdout.Close()\n\t\tcmd.Stdout = stdout\n\n\t\t// Redirect stderr into another file for later debugging.\n\t\tstderr, fileErr := os.OpenFile(bootstrapStderrPath, os.O_RDWR|os.O_CREATE, 0644)\n\t\tif fileErr != nil {\n\t\t\treturn false, fmt.Errorf(\"failed to create alloc/logs/envoy_bootstrap.stderr.0 for envoy: %w\", fileErr)\n\t\t}\n\t\tdefer stderr.Close()\n\t\tcmd.Stderr = stderr\n\n\t\t// Generate bootstrap\n\t\tcmdErr = cmd.Run()\n\n\t\t// Command succeeded, exit.\n\t\tif cmdErr == nil {\n\t\t\t// Bootstrap written. Move on without marking as Done as Prestart needs\n\t\t\t// to rerun after node reboots.\n\t\t\treturn false, nil\n\t\t}\n\n\t\t// Command failed, prepare for retry\n\t\t//\n\t\t// Cleanup the bootstrap file. An errors here is not\n\t\t// important as (a) we test to ensure the deletion","sourceCodeStart":364,"sourceCodeEnd":400,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/envoy_bootstrap_hook.go#L364-L400","documentation":"Same retry closure as the bootstrap stdout file: the hook opens alloc/logs/envoy_bootstrap.stderr.N with os.OpenFile to capture the consul command's stderr. This error wraps a failure to open/create that stderr debug file, so the bootstrap command is not run and Prestart fails.","triggerScenarios":"os.OpenFile(bootstrapStderrPath, os.O_RDWR|os.O_CREATE, 0644) fails — the logs directory is missing, unwritable, or the filesystem errors.","commonSituations":"alloc/logs directory deleted or never provisioned; permission/ownership issues on the alloc dir; read-only or full disk; sandbox policies blocking file creation.","solutions":["Ensure the alloc dir's logs/ directory exists and is writable by the Nomad client user.","Check disk space and filesystem health on the alloc-dir volume.","Review SELinux/AppArmor or container sandbox denials.","Restart the allocation so the task runner recreates the directory layout."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// ensure the logs directory exists and is writable before Prestart\nif err := os.MkdirAll(filepath.Join(allocDir, \"logs\"), 0o750); err != nil { return err }\nif fi, err := os.Stat(filepath.Join(allocDir, \"logs\")); err != nil || !fi.IsDir() {\n    return fmt.Errorf(\"alloc logs dir unavailable\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Preserve the alloc/logs directory lifecycle managed by the task runner.","Monitor filesystem health (I/O errors, quotas) on the alloc-dir volume.","Avoid external log collectors mutating ownership of alloc/logs.","Run Nomad with a client user permitted to create files under the alloc dir."],"tags":["go","filesystem","nomad","envoy","file-create"],"backgroundTag":"file-create-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}