{"record":{"id":"303b34f8633515cc","repo":"Billionmail/BillionMail","slug":"failed-to-create-temporary-container-w","errorCode":null,"errorMessage":"failed to create temporary container: %w","messagePattern":"failed to create temporary container: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/internal/service/dockerapi/dockerapi.go","lineNumber":320,"sourceCode":"\t\t\t\tType:   mount.TypeBind,\n\t\t\t\tSource: \"/\",          // Host root directory\n\t\t\t\tTarget: \"/host_root\", // Mount point in the container\n\t\t\t},\n\t\t},\n\t\tNetworkMode: \"host\", // No network needed\n\t}\n\n\t// Create temporary container\n\tresp, err := d.client.ContainerCreate(\n\t\tctx,\n\t\tconfig,\n\t\thostConfig,\n\t\tnil,\n\t\tnil,\n\t\t\"\",\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create temporary container: %w\", err)\n\t}\n\tcontainerID := resp.ID\n\tdefer d.cleanupContainer(ctx, containerID) // Ensure container is cleaned up\n\n\t// Start container\n\tif err := d.client.ContainerStart(ctx, containerID, container.StartOptions{}); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to start temporary container: %w\", err)\n\t}\n\n\t// Wait for container execution to complete\n\tstatusCh, errCh := d.client.ContainerWait(ctx, containerID, container.WaitConditionNotRunning)\n\tselect {\n\tcase err := <-errCh:\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed waiting for container execution: %w\", err)\n\t\t}\n\tcase status := <-statusCh:\n\t\tresult.ExitCode = int(status.StatusCode)","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/service/dockerapi/dockerapi.go#L302-L338","documentation":"ExecHostCommand runs a command on the host by creating a privileged temporary alpine container with the host root bind-mounted at /host_root (dockerapi.go:260-362). This error wraps any failure from the Docker SDK client.ContainerCreate call, meaning the Docker daemon rejected or could not fulfill the container creation request. It fires only after docker.sock has been confirmed mounted, so the daemon itself was reachable but creation failed.","triggerScenarios":"Calling ExecHostCommand/ExecHostShellCommand (directly or via addNewRules/deleteOldRules for firewall rule updates) when ContainerCreate fails: the alpine:latest image is absent and unpullable, invalid Cmd/Entrypoint combination, bind-mount of '/' rejected, 'host' network mode unavailable (e.g. rootless/swap-none setups), name conflict, or daemon out of disk/resources.","commonSituations":"Rootless Docker cannot use host network mode or privileged bind mount of /; Docker daemon stopped or restarting; SELinux/AppArmor blocking the /:/host_root bind mount; no internet access to pull alpine:latest on a fresh install; disk full on the daemon host.","solutions":["Verify the daemon logs (journalctl -u docker) for the underlying cause returned in the wrapped %w error","Ensure the environment permits privileged containers with a bind mount of / and network_mode=host (not rootless Docker)","Pre-pull the alpine:latest image manually: docker pull alpine:latest","Free disk space / restart the Docker daemon, then retry"],"exampleFix":"// before\nresp, err := d.client.ContainerCreate(ctx, config, hostConfig, nil, nil, \"\")\nif err != nil {\n\treturn nil, fmt.Errorf(\"failed to create temporary container: %w\", err)\n}\n// after: surface the daemon message verbatim and log the attempted command\nresp, err := d.client.ContainerCreate(ctx, config, hostConfig, nil, nil, \"\")\nif err != nil {\n\tg.Log().Errorf(ctx, \"ContainerCreate cmd=%v: %v\", command, err)\n\treturn nil, fmt.Errorf(\"failed to create temporary container (cmd=%v): %w\", command, err)\n}","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(\"/var/run/docker.sock\"); err != nil {\n\treturn fmt.Errorf(\"docker socket unavailable: %w\", err)\n}\n// also verify image present and daemon reachable before creating\nif _, err := d.client.Ping(ctx); err != nil {\n\treturn fmt.Errorf(\"docker daemon unreachable: %w\", err)\n}","typeGuard":"func canRunPrivilegedBinds() bool {\n\t// rootless docker cannot do privileged + host bind of /\n\treturn os.Geteuid() == 0\n}","tryCatchPattern":"result, err := docker.ExecHostCommand(ctx, cmd)\nif err != nil {\n\tvar derr error\n\tif errors.As(err, &derr) && strings.Contains(err.Error(), \"failed to create temporary container\") {\n\t\t// inspect docker daemon state / fallback to direct exec\n\t}\n\treturn err\n}","preventionTips":["Pre-pull alpine:latest at deployment time so creation never depends on network","Confirm deployment uses rootful Docker with privileges and host bind mounts allowed","Monitor daemon disk usage and health before issuing container operations","Log the full wrapped daemon error, not just the wrapper message"],"tags":["docker","container-creation","devops"],"backgroundTag":"docker-container-create-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}