{"record":{"id":"1bdfa3598f08b228","repo":"hashicorp/nomad","slug":"mount-rbind-s-s-failed-q","errorCode":null,"errorMessage":"mount --rbind %s %s failed: %q","messagePattern":"mount --rbind (.+?) (.+?) failed: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/lib/nsutil/netns_linux.go","lineNumber":60,"sourceCode":"\terr := os.MkdirAll(NetNSRunDir, 0755)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Remount the namespace directory shared. This will fail if it is not\n\t// already a mountpoint, so bind-mount it on to itself to \"upgrade\" it\n\t// to a mountpoint.\n\terr = unix.Mount(\"\", NetNSRunDir, \"none\", unix.MS_SHARED|unix.MS_REC, \"\")\n\tif err != nil {\n\t\tif err != unix.EINVAL {\n\t\t\treturn nil, fmt.Errorf(\"mount --make-rshared %s failed: %q\", NetNSRunDir, err)\n\t\t}\n\n\t\t// Recursively remount /var/run/netns on itself. The recursive flag is\n\t\t// so that any existing netns bindmounts are carried over.\n\t\terr = unix.Mount(NetNSRunDir, NetNSRunDir, \"none\", unix.MS_BIND|unix.MS_REC, \"\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"mount --rbind %s %s failed: %q\", NetNSRunDir, NetNSRunDir, err)\n\t\t}\n\n\t\t// Now we can make it shared\n\t\terr = unix.Mount(\"\", NetNSRunDir, \"none\", unix.MS_SHARED|unix.MS_REC, \"\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"mount --make-rshared %s failed: %q\", NetNSRunDir, err)\n\t\t}\n\n\t}\n\n\t// create an empty file at the mount point\n\tnsPath := path.Join(NetNSRunDir, nsName)\n\tmountPointFd, err := os.Create(nsPath)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tmountPointFd.Close()\n","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/lib/nsutil/netns_linux.go#L42-L78","documentation":"When the initial shared remount of /var/run/netns returns EINVAL, the directory is not yet a mountpoint, so NewNS recursively bind-mounts /var/run/netns onto itself to 'upgrade' it. If that bind-mount fails, this error is returned. It means the kernel refused the recursive bind mount of the netns directory onto itself.","triggerScenarios":"unix.Mount(NetNSRunDir, NetNSRunDir, \"none\", MS_BIND|MS_REC) returns an error during NewNS (via CreateNetwork), i.e. /var/run/netns is not a mountpoint AND the self bind-mount is denied (EPERM, ENOENT, etc.).","commonSituations":"Unprivileged container runtimes denying mounts; /var/run/netns deleted between the first Mount and the bind-mount; read-only /run filesystem (EROFS) in locked-down containers.","solutions":["Run with CAP_SYS_ADMIN / privileged mode so bind mounts are permitted","Pre-create and pre-mount the directory on the host: mkdir -p /run/netns && mount --bind /run/netns /run/netns","Check the filesystem is writable (not mounted read-only)","On predefined shared volumes, mount /run/netns as shared into the container"],"exampleFix":"// before: read-only /run causes failure\n// after (host setup before starting the container):\n// mkdir -p /run/netns && mount --bind /run/netns /run/netns && mount --make-shared /run/netns\nns, err := nsutil.NewNS()","handlingStrategy":"validation","validationCode":"if err := unix.Mount(\"/run/netns\", \"/run/netns\", \"\", unix.MS_BIND|unix.MS_REC, \"\"); err != nil {\n    return fmt.Errorf(\"/run/netns cannot be bind-mounted (need CAP_SYS_ADMIN): %v\", err)\n}","typeGuard":null,"tryCatchPattern":"ns, err := nsutil.NewNS()\nif err != nil && strings.Contains(err.Error(), \"--rbind\") {\n    return fmt.Errorf(\"cannot upgrade /run/netns to a mountpoint; pre-mount it on the host: %w\", err)\n}","preventionTips":["Pre-create and bind-mount /run/netns onto itself in the container entrypoint","Keep /run writable; do not mount it read-only","Grant SYS_ADMIN capability in deployment specs","Verify with 'findmnt /run/netns' that it is a mountpoint before startup"],"tags":["linux","network-namespace","mount","bind-mount"],"backgroundTag":"mount-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}