{"record":{"id":"7a86c7b4da363804","repo":"vxcontrol/pentagi","slug":"failed-to-create-tmp-directory-w","errorCode":null,"errorMessage":"failed to create tmp directory: %w","messagePattern":"failed to create tmp directory: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"backend/pkg/docker/client.go","lineNumber":171,"sourceCode":"\t\t\t\t\"container, so any process inside it gets control of the same daemon that runs \" +\n\t\t\t\t\"PentAGI. Set DOCKER_SOCKET or DOCKER_INSIDE_HOST explicitly, or front the socket \" +\n\t\t\t\t\"with a least-privilege proxy (e.g. Tecnativa/docker-socket-proxy), if that is not intended.\")\n\t\t}\n\t}\n\tnetName := cfg.DockerNetwork\n\tpublicIP := cfg.DockerPublicIP\n\tdefImage := strings.ToLower(cfg.DockerDefaultImage)\n\tif defImage == \"\" {\n\t\tdefImage = defaultImage\n\t}\n\n\tdataDir, err := filepath.Abs(cfg.DataDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get absolute path: %w\", err)\n\t}\n\n\tif err := os.MkdirAll(dataDir, 0755); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create tmp directory: %w\", err)\n\t}\n\n\thostDir := getHostDataDir(ctx, cli, dataDir, cfg.DockerWorkDir)\n\n\t// ensure network exists if configured\n\tif err := ensureDockerNetwork(ctx, cli, netName); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to ensure docker network %s: %w\", netName, err)\n\t}\n\n\tlogger := logrus.StandardLogger()\n\tlogger.WithFields(logrus.Fields{\n\t\t\"docker_name\":        info.Name,\n\t\t\"docker_arch\":        info.Architecture,\n\t\t\"docker_version\":     info.ServerVersion,\n\t\t\"client_version\":     cli.ClientVersion(),\n\t\t\"data_dir\":           dataDir,\n\t\t\"host_dir\":           hostDir,\n\t\t\"docker_inside\":      inside,","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/docker/client.go#L153-L189","documentation":"After resolving the data directory, NewDockerClient calls os.MkdirAll(dataDir, 0755) to guarantee the per-flow working directory root exists (it is bind-mounted into sandbox containers). Any filesystem failure creating that directory is wrapped as \"failed to create tmp directory: %w\". This is a real I/O error, unlike error 251: the path resolution succeeded but the directory could not be created.","triggerScenarios":"os.MkdirAll(dataDir, 0755) fails: parent path component is a regular file, permission denied, read-only filesystem, disk full, or SELinux/AppArmor denies creation at that path.","commonSituations":"DATA_DIR points under a path owned by root while the app runs as non-root; a file already exists where a directory is expected (leftover from a bad cleanup); mounting DATA_DIR as a read-only volume in Docker Compose; SELinux denial on a custom path; full disk on a small VM.","solutions":["Check ownership/permissions on DATA_DIR and its parents; chown to the user running PentAGI (chown -R 1000:1000 /var/lib/pentagi).","Verify the path is not an existing regular file; remove or rename the file, or choose another DATA_DIR.","Remove any 'ro' flag on the DATA_DIR volume mount in docker-compose.yml.","Check disk space (df -h) and SELinux denials (ausearch -m avc) if permissions look correct."],"exampleFix":"// before (docker-compose.yml)\nvolumes:\n  - /var/lib/pentagi/data:/data:ro\n// after\nvolumes:\n  - /var/lib/pentagi/data:/data","handlingStrategy":"validation","validationCode":"func ensureDataDirWritable(path string) error {\n    st, err := os.Stat(path)\n    if err == nil && !st.IsDir() {\n        return fmt.Errorf(\"%s exists and is not a directory\", path)\n    }\n    probe := filepath.Join(path, \".write-probe\")\n    if err := os.WriteFile(probe, nil, 0644); err != nil {\n        return fmt.Errorf(\"DATA_DIR not writable: %w\", err)\n    }\n    os.Remove(probe)\n    return nil\n}\n// call ensureDataDirWritable(cfg.DataDir) before NewDockerClient","typeGuard":null,"tryCatchPattern":"if _, err := NewDockerClient(ctx, db, cfg); err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) && errors.Is(pe, os.ErrPermission) {\n        log.Fatalf(\"cannot create DATA_DIR %s: %v — chown/chmod the path\", cfg.DataDir, err)\n    }\n    return err\n}","preventionTips":["Pre-create DATA_DIR in the deployment (volume + chown) instead of relying on the app.","Never mount DATA_DIR read-only; verify compose volume flags.","Check SELinux/AppArmor policies for custom data paths.","Monitor disk space on the data volume."],"tags":["filesystem","permissions","startup"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}