{"record":{"id":"8be5cc14af27e709","repo":"dagger/dagger","slug":"mount-meta-mount-w","errorCode":null,"errorMessage":"mount meta mount: %w","messagePattern":"mount meta mount: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/engineutil/executor_spec.go","lineNumber":538,"sourceCode":"\tif metaMount != nil {\n\t\tswitch metaMount.Type {\n\t\tcase \"bind\", \"rbind\":\n\t\t\tstate.metaMountDirPath = metaMount.Source\n\t\tdefault:\n\t\t\tmntPath, err := os.MkdirTemp(\"\", \"meta-mount\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"create meta mount temp dir: %w\", err)\n\t\t\t}\n\t\t\tstate.cleanups.Add(\"remove meta mount temp dir\", func() error {\n\t\t\t\treturn os.RemoveAll(mntPath)\n\t\t\t})\n\t\t\tmnts := []mount.Mount{{\n\t\t\t\tType:    metaMount.Type,\n\t\t\t\tSource:  metaMount.Source,\n\t\t\t\tOptions: metaMount.Options,\n\t\t\t}}\n\t\t\tif err := mount.All(mnts, mntPath); err != nil {\n\t\t\t\treturn fmt.Errorf(\"mount meta mount: %w\", err)\n\t\t\t}\n\t\t\tstate.cleanups.Add(\"unmount meta mount\", func() error {\n\t\t\t\treturn mount.UnmountMounts(mnts, mntPath, 0)\n\t\t\t})\n\t\t\tstate.metaMountDirPath = mntPath\n\t\t}\n\t}\n\n\tstate.cleanups.Add(\"cleanup rootfs stubs\", cleanups.Infallible(executor.MountStubsCleaner(\n\t\tctx,\n\t\tstate.rootfsPath,\n\t\tstate.mounts,\n\t\tstate.procInfo.Meta.RemoveMountStubsRecursive,\n\t)))\n\n\tfor _, mnt := range state.nonRootMounts {\n\t\tmnt, recursiveReadOnly := consumeRecursiveReadOnlyOption(mnt)\n\t\tdstPath, err := fs.RootPath(state.spec.Root.Path, mnt.Target)","sourceCodeStart":520,"sourceCodeEnd":556,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/engineutil/executor_spec.go#L520-L556","documentation":"This error wraps a failure from containerd's mount.All() while mounting the 'meta mount' (the Dagger scratch/communication mount used to pass exit codes between executor and container) at a temporary directory during setupRootfs. The meta mount is only mounted into a temp dir when it is not a bind/rbind mount; any kernel/syscall-level mount failure (unsupported fs type, missing privileges, missing source) surfaces here. It is a low-level mount(2) failure raised by the Dagger executor before the container starts.","triggerScenarios":"setupRootfs encounters a spec.Mounts entry whose Destination is MetaMountDestPath with a non-bind type (e.g. overlay/tmpfs) and mount.All fails: the mount source doesn't exist, the filesystem type is unsupported by the kernel, options are invalid, or the process lacks CAP_SYS_ADMIN.","commonSituations":"Running the engine in a restricted container/VM (Docker-in-Docker, sandboxed CI) without mount privileges; a corrupted or removed scratch source directory; kernel without support for the requested mount type; leftover stale state after an engine upgrade.","solutions":["Verify the executor process has CAP_SYS_ADMIN / runs in a privileged context so mount(2) is permitted","Check that the meta mount source path exists and is of the expected type (ls -la on the source)","Confirm the kernel supports the requested mount type and options (try the mount manually)","Restart the engine/recreate its scratch state to clear corrupted meta mount sources","Collect the wrapped inner error (%w) for the actual syscall errno and address that specifically"],"exampleFix":"// before (engine run unprivileged in nested container)\n$ docker run ... dagger-engine  # mount meta mount: permission denied\n// after\n$ docker run --privileged ... dagger-engine  # or a container runtime config granting CAP_SYS_ADMIN","handlingStrategy":"validation","validationCode":"if !hasCapSysAdmin() { return errors.New(\"executor needs CAP_SYS_ADMIN to mount meta mount; run privileged\") }\nif _, err := os.Stat(metaMountSource); err != nil { return fmt.Errorf(\"meta mount source missing: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := client.Container().From(alpine).Sync(ctx); err != nil {\n\tvar meta *fs.PathError\n\tif strings.Contains(err.Error(), \"mount meta mount\") {\n\t\t// engine lacks privileges or scratch state corrupted; restart engine privileged\n\t}\n}","preventionTips":["Run the engine in a privileged container or with CAP_SYS_ADMIN","Keep the engine's scratch/workdir volumes healthy and mounted consistently","Pin kernel/runtime versions known to support the engine's mount types","Wrap engine startup with a health check that exercises a simple exec"],"tags":["filesystem","mount","container","dagger-engine"],"backgroundTag":"mount-failure","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}