{"record":{"id":"6a335ec8bea54685","repo":"hashicorp/nomad","slug":"failed-to-mount-task-dir-v","errorCode":null,"errorMessage":"Failed to mount task dir: %v","messagePattern":"Failed to mount task dir: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocdir/task_dir.go","lineNumber":200,"sourceCode":"\t\t}\n\n\t\tnobodyUID, nobodyGID, _, err := dynamic.LookupUser(\"nobody\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup nobody user: %v\", err)\n\t\t}\n\n\t\t// create the task unique directory under the client mounts path\n\t\tparent := filepath.Dir(t.MountsAllocDir)\n\t\tif err = os.MkdirAll(parent, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to create task mount directory: %v\", err)\n\t\t}\n\t\tif err = os.Chown(parent, uid, gid); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to chown task mount directory: %v\", err)\n\t\t}\n\n\t\t// create the taskdir mount point\n\t\tif err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount task dir: %v\", err)\n\t\t}\n\n\t\t// create the allocdir mount point (owned by nobody)\n\t\tif err = mountDir(filepath.Join(t.AllocDir, \"/alloc\"), t.MountsAllocDir, nobodyUID, nobodyGID, fileMode777); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount alloc dir: %v\", err)\n\t\t}\n\n\t\t// create the secretsdir mount point\n\t\tif err = mountDir(t.SecretsDir, t.MountsSecretsDir, uid, gid, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount secrets dir: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// buildChroot takes a mapping of absolute directory or file paths on the host\n// to their intended, relative location within the task directory. This","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocdir/task_dir.go#L182-L218","documentation":"TaskDir.Build (Unveil mode) calls mountDir(t.Dir, t.MountsTaskDir, ...) to bind-mount the task directory into the client mounts path. This error wraps mountDir's failure for the task dir. mountDir typically creates the mount point and performs a bind mount, so failures come from mount(2) or mount-point setup.","triggerScenarios":"mountDir fails while building the task-dir mount point under fsisolation.Unveil: bind mounts disabled, mount point creation failed, or the source task dir vanished mid-build.","commonSituations":"Client running inside an unprivileged container without CAP_SYS_ADMIN (bind mount → EPERM); host with mount propagation restrictions; stale leftover mount at the target from a previous crashed alloc.","solutions":["Inspect the wrapped error from mountDir: EPERM/EACCES → run client as root or grant CAP_SYS_ADMIN; EBUSY → unmount stale target (`umount <MountsTaskDir>`)","Verify the host allows bind mounts (no `--security-opt no-new-privileges`/seccomp denial when containerized)","Check `mount | grep <data_dir>` for leftover mounts from dead allocs and clean them","If bind mounts are unsupported on the platform, use a driver/fs-isolation mode without Unveil mounts"],"exampleFix":"# before\nFailed to mount task dir: permission denied\n# after (containerized client)\ndocker run --cap-add SYS_ADMIN ... # or run nomad directly on host as root\n$ umount /var/nomad/client/mounts/<alloc>/task  # clear stale mount first","handlingStrategy":"try-catch","validationCode":"// preflight: can we bind-mount at all?\nif err := syscall.Mount(src, dst, \"\", syscall.MS_BIND, \"\"); err != nil {\n    log.Fatalf(\"bind mounts unavailable (run as root / add CAP_SYS_ADMIN): %v\", err)\n} else {\n    syscall.Unmount(dst, 0)\n}","typeGuard":null,"tryCatchPattern":"if err := taskDir.Build(fsi, chroot, username); err != nil {\n    if strings.Contains(err.Error(), \"Failed to mount task dir\") {\n        // umount stale target, ensure root/CAP_SYS_ADMIN, retry build\n        exec.Command(\"umount\", mountsTaskDir).Run()\n        return retryBuild()\n    }\n    return err\n}","preventionTips":["Run the client directly on the host as root, or grant CAP_SYS_ADMIN in containers","Clean leftover mounts under data_dir/client/mounts after crashes","Monitor dmesg for mount denials (seccomp/AppArmor)","Avoid filesystems that disallow bind mounts for data_dir"],"tags":["filesystem","mount","nomad-client"],"backgroundTag":"mount-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}