{"record":{"id":"429aee7635bb154e","repo":"dagger/dagger","slug":"move-mount-to-s-w","errorCode":null,"errorMessage":"move mount to %s: %w","messagePattern":"move mount to (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/service.go","lineNumber":1605,"sourceCode":"\t\t{Type: specs.MountNamespace},\n\t}, func() error {\n\t\t// Create target directory if it doesn't exist\n\t\tif _, err := os.Stat(targetPath); os.IsNotExist(err) {\n\t\t\tif err := os.MkdirAll(targetPath, 0755); err != nil && !os.IsExist(err) {\n\t\t\t\treturn fmt.Errorf(\"mkdir %s: %w\", targetPath, err)\n\t\t\t}\n\t\t}\n\n\t\t// Unmount any existing mount at the target path\n\t\terr = unix.Unmount(targetPath, unix.MNT_DETACH)\n\t\tif err != nil && err != unix.EINVAL && err != unix.ENOENT {\n\t\t\tslog.Warn(\"unmount failed during container remount\", \"path\", targetPath, \"error\", err)\n\t\t\t// Continue anyway, might not be mounted\n\t\t}\n\n\t\terr = unix.MoveMount(fdMnt, \"\", unix.AT_FDCWD, targetPath, unix.MOVE_MOUNT_F_EMPTY_PATH)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"move mount to %s: %w\", targetPath, err)\n\t\t}\n\n\t\treturn nil\n\t})\n}\n\ntype ServiceBindings []ServiceBinding\n\ntype ServiceBinding struct {\n\tService  dagql.ObjectResult[*Service]\n\tHostname string\n\tAliases  AliasSet\n}\n\n// recordBoundServiceFQDNs notes, for each freshly started binding, the fully\n// qualified name the running service registered in DNS under, so the executor\n// can resolve it directly instead of re-deriving the bare hostname against the\n// consuming exec's search domains.","sourceCodeStart":1587,"sourceCodeEnd":1623,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/core/service.go#L1587-L1623","documentation":"mountIntoContainer wraps a failure of the move_mount(2) syscall that attaches the cloned mount tree at targetPath inside the container's mount namespace. Dagger throws it when the kernel rejects attaching the prepared mount FD at the destination. The wrapped errno identifies the specific cause.","triggerScenarios":"Running a directory-into-container mount (via the mutable-copy remount path) where move_mount returns an error: invalid target path, cross-filesystem restrictions, missing CAP_SYS_ADMIN in the target namespace, or kernel lacking move_mount support (<5.2).","commonSituations":"Old kernels without move_mount(2) (returns ENOSYS); target path was removed between mkdir and mount; seccomp/apparmor policy blocking move_mount; userns without mount privileges.","solutions":["Run on a kernel >= 5.2 that supports move_mount(2) and check the engine host kernel version","Confirm the engine container/runtime grants mount capabilities (CAP_SYS_ADMIN, allowed syscalls in seccomp profile)","Ensure the target path still exists and is a directory at mount time","Read the wrapped errno (ENOSYS/EINVAL/EPERM) to pinpoint whether it's kernel, capability, or path related"],"exampleFix":"// before\n// kernel 4.x host: move_mount -> ENOSYS\n// after\n// upgrade host kernel to >=5.2 or run the engine on a newer node","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if errors.Is(err, unix.ENOSYS) || errors.Is(err, syscall.ENOSYS) {\n    log.Fatal(\"move_mount(2) unsupported: kernel >= 5.2 required\")\n}\nif errors.Is(err, unix.EPERM) { log.Printf(\"mount capability denied: %v\", err) }","preventionTips":["Run the engine on kernels >= 5.2 that implement move_mount(2)","Ensure the container runtime grants mount privileges (no restrictive seccomp dropping move_mount)","Avoid mutating/removing the target path while the mount is in flight"],"tags":["mount","kernel","syscall","container","namespace"],"backgroundTag":"move-mount-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}