{"record":{"id":"3c98b8a01b6c8cd2","repo":"hashicorp/nomad","slug":"failed-to-write-bootstrap-command-line-w","errorCode":null,"errorMessage":"failed to write bootstrap command line: %w","messagePattern":"failed to write bootstrap command line: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/envoy_bootstrap_hook.go","lineNumber":320,"sourceCode":"\tbootstrapCmdPath := filepath.Join(req.TaskDir.SecretsDir, \".envoy_bootstrap.cmd\")\n\n\tsiToken, err := h.maybeLoadSIToken(req.Task.Name, req.TaskDir.SecretsDir)\n\tif err != nil {\n\t\th.logger.Error(\"failed to generate envoy bootstrap config\", \"sidecar_for\", service.Name)\n\t\treturn fmt.Errorf(\"failed to generate envoy bootstrap config: %w\", err)\n\t}\n\th.logger.Debug(\"check for SI token for task\", \"task\", req.Task.Name, \"exists\", siToken != \"\")\n\n\tproxyID := h.proxyServiceID(h.alloc.TaskGroup, service)\n\tbootstrap := h.newEnvoyBootstrapArgs(service, grpcAddr, envoyAdminBind, envoyReadyBind, siToken, bootstrapFilePath, proxyID)\n\n\t// Create command line arguments\n\tbootstrapArgs := bootstrap.args()\n\n\t// Write args to file for debugging\n\targsFile, err := os.Create(bootstrapCmdPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to write bootstrap command line: %w\", err)\n\t}\n\tdefer argsFile.Close()\n\tif _, err := io.WriteString(argsFile, strings.Join(bootstrapArgs, \" \")+\"\\n\"); err != nil {\n\t\treturn fmt.Errorf(\"failed to encode bootstrap command line: %w\", err)\n\t}\n\n\t// Create environment\n\tbootstrapEnv := bootstrap.env(h.groupEnv())\n\n\t// Write env to file for debugging\n\tenvFile, err := os.Create(bootstrapEnvPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to write bootstrap environment: %w\", err)\n\t}\n\tdefer envFile.Close()\n\tenvEnc := json.NewEncoder(envFile)\n\tenvEnc.SetIndent(\"\", \"    \")\n\tif err := envEnc.Encode(bootstrapEnv); err != nil {","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/envoy_bootstrap_hook.go#L302-L338","documentation":"For debugging, the envoy bootstrap hook writes the generated envoy bootstrap command-line arguments to .envoy_bootstrap.cmd in the task's SecretsDir. This error wraps an os.Create failure for that debug file; it is about persisting the debug artifact, not about generating the bootstrap itself.","triggerScenarios":"os.Create(bootstrapCmdPath) fails because SecretsDir does not exist, is read-only, is out of disk, or permissions forbid the Nomad user from creating files there.","commonSituations":"Full disk on the client; secrets directory removed by a prior failed task step; restrictive umask or SELinux policy blocking file creation in the secrets dir.","solutions":["Check the wrapped OS error (disk full? no such directory? permission denied?)","Verify the task SecretsDir exists and is writable by the Nomad client user","Free disk space on the client data volume if ENOSPC","Fix SELinux/AppArmor denials if they block creation in SecretsDir","Retry the allocation after filesystem repair"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if info, err := os.Stat(secretsDir); err != nil || !info.IsDir() {\n    return fmt.Errorf(\"secrets dir %s not ready: %w\", secretsDir, err)\n}\nif err := unix.Access(secretsDir, unix.W_OK); err != nil {\n    return fmt.Errorf(\"secrets dir %s not writable: %v\", secretsDir, err)\n}","typeGuard":null,"tryCatchPattern":"if err := hook.Prestart(req); err != nil {\n    var pe *os.PathError\n    if errors.As(err, &pe) && strings.Contains(err.Error(), \"bootstrap command line\") {\n        log.Printf(\"debug artifact write failed on %s: %v\", pe.Path, pe.Err)\n    }\n}","preventionTips":["Ensure the secrets directory is created and writable before task hooks","Monitor client disk space to avoid ENOSPC","Keep umask/permissions permissive enough for the nomad user","Review LSM (SELinux/AppArmor) policies for the Nomad data paths"],"tags":["envoy","consul-connect","filesystem"],"backgroundTag":"file-write-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}