{"record":{"id":"5a54fd31eaf2dbee","repo":"dagger/dagger","slug":"failed-to-open-bundle-for-writing-w","errorCode":null,"errorMessage":"failed to open bundle for writing: %w","messagePattern":"failed to open bundle for writing: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/engineutil/cacerts/distros.go","lineNumber":450,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"failed to set mtime of bundle during install: %w\", err)\n\t\t\t}\n\t\t\treturn nil\n\t\t})\n\t} else {\n\t\td.createdBundleParentDir, err = d.ctrFS.MkdirAll(filepath.Dir(d.bundlePath), 0755)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create bundle parent dir: %w\", err)\n\t\t}\n\t\tif d.createdBundleParentDir != \"\" {\n\t\t\tcleanups.append(func() error {\n\t\t\t\treturn d.ctrFS.RemoveAll(d.createdBundleParentDir)\n\t\t\t})\n\t\t}\n\t}\n\n\tf, err := d.ctrFS.OpenFile(d.bundlePath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open bundle for writing: %w\", err)\n\t}\n\tdefer f.Close()\n\tfor installCert := range d.installedCerts {\n\t\t// skip installing certs that are already in the bundle\n\t\tif _, exists := d.existingBundledCerts[installCert]; exists {\n\t\t\tdelete(d.installedCerts, installCert)\n\t\t\tcontinue\n\t\t}\n\t\tif _, err := f.WriteString(installCert + \"\\n\\n\"); err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// cleanup handled above with origBundleContents\n\t}\n\td.updatedBundleMtime, err = d.ctrFS.MtimeOf(d.bundlePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get mtime of updated bundle: %w\", err)\n\t}\n\treturn nil","sourceCodeStart":432,"sourceCodeEnd":468,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/engineutil/cacerts/distros.go#L432-L468","documentation":"After preparing the bundle (snapshot or parent dir), Install opens the bundle file with O_CREATE|O_APPEND|O_WRONLY to append the new CA certificates. This error wraps a failure of that OpenFile call, meaning the installer could not get a writable handle to the CA bundle.","triggerScenarios":"ctrFS.OpenFile(d.bundlePath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644) fails: bundle path is a directory, parent dir is read-only or unwritable, permission denied on an existing bundle file, or the path was replaced by something non-openable after preparation.","commonSituations":"Non-root container without write access to /etc/ssl/certs; a bind-mount or symlink made the bundle path point at a directory; read-only root filesystem.","solutions":["Check the wrapped os error (EISDIR, EACCES, EROFS) and fix the path/permissions it indicates.","Ensure the container runs with write permission on the bundle path and its parent directory.","Verify nothing replaced the bundle with a directory or read-only file between preparation and open.","Remount the target filesystem writable if it is mounted read-only."],"exampleFix":"// before: container user 'nobody' cannot open /etc/ssl/certs/ca-certificates.crt for append\n// after: run the container as root\n// docker run --user root ... or add write capability to the custom-CA directory","handlingStrategy":"validation","validationCode":"fi, err := os.Stat(bundlePath)\nif err == nil && fi.IsDir() {\n    return fmt.Errorf(\"%s is a directory, not a file\", bundlePath)\n}\nif err := unix.Access(filepath.Dir(bundlePath), unix.W_OK); err != nil {\n    return fmt.Errorf(\"no write access to %s: %w\", filepath.Dir(bundlePath), err)\n}","typeGuard":null,"tryCatchPattern":"if err := installer.Install(ctx); err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) {\n        switch {\n        case errors.Is(pe.Err, syscall.EACCES):\n            return fmt.Errorf(\"run as root or fix permissions on %s\", pe.Path)\n        case errors.Is(pe.Err, syscall.EROFS):\n            return fmt.Errorf(\"remount %s writable\", pe.Path)\n        }\n    }\n    return err\n}","preventionTips":["Run the container as root when custom CAs must be installed.","Do not bind-mount the bundle path as a directory or read-only file.","Check writability of the cert directory before engine startup."],"tags":["filesystem","ca-certificates","file-open","permissions"],"backgroundTag":"file-open-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}