{"record":{"id":"5c698c67e51c03a1","repo":"dagger/dagger","slug":"failed-to-unshare-mount-namespace-w","errorCode":null,"errorMessage":"failed to unshare mount namespace: %w","messagePattern":"failed to unshare mount namespace: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/engineutil/linux_namespace.go","lineNumber":390,"sourceCode":"func (nsw *dynamicNamespaceWorker) enterNamespaces() error {\n\tif nsw.inNamespace {\n\t\treturn nil\n\t}\n\n\truntime.LockOSThread()\n\n\tfor _, ns := range nsw.namespaces {\n\t\tif ns.setNSArg == unix.CLONE_NEWNS {\n\t\t\t// Unshare FS metadata first, otherwise setns to another mount\n\t\t\t// namespace doesn't work.\n\t\t\t//\n\t\t\t// Possibly relevant Kernel docs:\n\t\t\t//\n\t\t\t// For security reasons, a process can't join a new mount namespace if it\n\t\t\t// is sharing filesystem-related attributes (the attributes whose sharing\n\t\t\t// is controlled by the clone(2) CLONE_FS flag) with another process.\n\t\t\tif err := unix.Unshare(unix.CLONE_FS); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to unshare mount namespace: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\tif err := unix.Setns(int(ns.targetFile.Fd()), ns.setNSArg); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to enter namespace: %w\", err)\n\t\t}\n\t}\n\tnsw.inNamespace = true\n\treturn nil\n}\n\n// leaveNamespaces exits all namespaces and returns to host\nfunc (nsw *dynamicNamespaceWorker) leaveNamespaces() error {\n\tif !nsw.inNamespace {\n\t\treturn nil\n\t}\n\n\tfor _, ns := range nsw.namespaces {","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/engineutil/linux_namespace.go#L372-L408","documentation":"Before setns into a new mount namespace, the kernel requires the thread not share filesystem attributes (CLONE_FS) with another thread; the worker calls unix.Unshare(unix.CLONE_FS) first. This error means that unshare syscall failed, so joining the target mount namespace was aborted.","triggerScenarios":"unix.Unshare(unix.CLONE_FS) returns an error while entering a MountNamespace entry, typically EINVAL/EPERM from kernel restrictions.","commonSituations":"Thread's fs attributes are shared (CLONE_FS) and the kernel disallows unshare in this context; unprivileged environment without CAP_SYS_ADMIN; kernel/seccomp blocking unshare syscall (common in restricted containers); Go runtime thread state interactions.","solutions":["Ensure the process has CAP_SYS_ADMIN in the target namespace's user namespace","Check seccomp profile allows unshare (default Docker/containerd seccomp blocks it in some configs)","Update the kernel; very old kernels had restrictions on unshare from multithreaded processes","Drop the mount namespace from the job if only network namespace isolation is needed"],"exampleFix":"// before\nif err := unix.Unshare(unix.CLONE_FS); err != nil { return err } // EPERM under restrictive seccomp\n// after\nif err := unix.Unshare(unix.CLONE_FS); err != nil {\n    return fmt.Errorf(\"unshare(CLONE_FS) failed (needs CAP_SYS_ADMIN and seccomp allowing unshare): %w\", err)\n}","handlingStrategy":"validation","validationCode":"// ensure unshare is permitted before submitting mount-ns jobs\nif err := unix.Unshare(unix.CLONE_FS); err != nil {\n    return fmt.Errorf(\"environment cannot unshare CLONE_FS: %w\", err)\n}\nunix.Setns /* restore as needed */","typeGuard":null,"tryCatchPattern":"if err := gwp.RunInNamespaces(ctx, id, nss, fn); err != nil {\n    if strings.Contains(err.Error(), \"failed to unshare mount namespace\") {\n        // run with CAP_SYS_ADMIN and a seccomp profile allowing unshare, or drop MountNamespace from the job\n    }\n}","preventionTips":["Run the engine privileged or with CAP_SYS_ADMIN","Check the container seccomp profile allows the unshare syscall","Only request MountNamespace when mount isolation is actually needed"],"tags":["linux","namespaces","mount","syscall"],"backgroundTag":"unshare-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}