{"record":{"id":"5f45778d418f392e","repo":"dagger/dagger","slug":"install-dnsmasq-w","errorCode":null,"errorMessage":"install dnsmasq: %w","messagePattern":"install dnsmasq: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/engine/main.go","lineNumber":948,"sourceCode":"\tbridge, err := network.BridgeFromCIDR(netCIDR)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"bridge from cidr: %w\", err)\n\t}\n\n\tif err := netinst.EnsureIptablesSymlinks(ctx); err != nil {\n\t\treturn nil, fmt.Errorf(\"ensure iptables symlinks: %w\", err)\n\t}\n\n\t// NB: this is needed for the Dagger shim worker at the moment for host alias\n\t// resolution\n\terr = netinst.InstallResolvconf(netName, bridge.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"install resolv.conf: %w\", err)\n\t}\n\n\terr = netinst.InstallDnsmasq(ctx, netName)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"install dnsmasq: %w\", err)\n\t}\n\n\tcniConfigPath, err := netinst.InstallCNIConfig(ctx, netName, netCIDR)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"install cni: %w\", err)\n\t}\n\n\treturn &networkConfig{\n\t\tNetName:       netName,\n\t\tNetCIDR:       netCIDR,\n\t\tBridge:        bridge,\n\t\tCNIConfigPath: cniConfigPath,\n\t}, nil\n}\n","sourceCodeStart":930,"sourceCodeEnd":963,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/cmd/engine/main.go#L930-L963","documentation":"This error wraps a failure from netinst.InstallDnsmasq, which installs/sets up the dnsmasq DHCP/DNS daemon for a Dagger engine network during setupNetwork in the engine's main entrypoint. It indicates dnsmasq could not be installed or configured for the given network (netName). Since setupNetwork runs at engine startup, a failure here aborts engine boot before any builds can run.","triggerScenarios":"Engine startup calls setupNetwork -> InstallDnsmasq(ctx, netName) which returns a non-nil error (e.g. binary missing, package manager failure, permission denied writing config, or network setup failure).","commonSituations":"Running the engine in a minimal container without dnsmasq available or installable; missing root/CAP_NET_ADMIN privileges to configure networking; read-only root filesystem preventing dnsmasq config installation; corrupted or unsupported network name.","solutions":["Ensure dnsmasq is installed on the host (e.g. apt-get install dnsmasq) and the install command it runs succeeds","Run the engine with sufficient privileges (root or CAP_NET_ADMIN/CAP_NET_RAW) so dnsmasq can be set up","Check the wrapped error (%w) for the underlying cause (disk full, read-only fs, missing binary) and fix that","Verify the root filesystem is writable where dnsmasq config/binary are installed"],"exampleFix":"// before: engine run in unprivileged container fails at boot\n// after: grant network capabilities or pre-install dnsmasq in the image\n//   Dockerfile: RUN apt-get update && apt-get install -y dnsmasq\n//   run: docker run --cap-add NET_ADMIN --cap-add NET_RAW ...","handlingStrategy":"validation","validationCode":"// before starting the engine, verify dnsmasq availability and privileges\nif _, err := exec.LookPath(\"dnsmasq\"); err != nil {\n    return fmt.Errorf(\"dnsmasq not installed: %w\", err)\n}\nif os.Geteuid() != 0 { /* or check CAP_NET_ADMIN */\n    return errors.New(\"engine network setup requires root/CAP_NET_ADMIN\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := setupNetwork(...); err != nil {\n    var wrapped *fmt.wrapError\n    if errors.As(err, &wrapped) {\n        log.Printf(\"network setup failed: %v\", wrapped.Unwrap())\n    }\n    // fail fast: engine cannot run without its network\n}","preventionTips":["Pre-install dnsmasq in the engine image rather than relying on runtime install","Always run the engine with CAP_NET_ADMIN/CAP_NET_RAW or root","Keep the root filesystem writable where network setup writes files","Test engine boot in minimal containers before deploying"],"tags":["network","dnsmasq","engine-startup"],"backgroundTag":"engine-network-setup-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}