{"record":{"id":"aaf6118ba4ab1ee3","repo":"dagger/dagger","slug":"setting-target-comm-w","errorCode":null,"errorMessage":"setting target comm: %w","messagePattern":"setting target comm: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/ebpf/filetracer/tracer.go","lineNumber":155,"sourceCode":"func New() (dagebpf.Tracer, error) {\n\tif err := ebpfutil.Prepare(); err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Load BPF objects\n\tvar objs fileopsObjects\n\tif err := loadFileopsObjects(&objs, nil); err != nil {\n\t\treturn nil, ebpfutil.WrapVerifierError(err, \"loading BPF objects\")\n\t}\n\n\t// Set target comm (process name) to filter by\n\ttargetComm := \"dagger-engine\"\n\tvar commBytes [16]byte\n\tcopy(commBytes[:], targetComm)\n\tzero := uint32(0)\n\tif err := objs.TargetComm.Put(zero, commBytes); err != nil {\n\t\tobjs.Close()\n\t\treturn nil, fmt.Errorf(\"setting target comm: %w\", err)\n\t}\n\n\tslog.Debug(\"filetracer: targeting process\", \"comm\", targetComm)\n\n\tvar links []link.Link\n\n\tcleanup := func() {\n\t\tfor _, l := range links {\n\t\t\tl.Close()\n\t\t}\n\t\tobjs.Close()\n\t}\n\n\t// Helper to attach a tracepoint\n\tattachTP := func(name string, prog *ebpf.Program, required bool) error {\n\t\tl, err := link.Tracepoint(\"syscalls\", name, prog, nil)\n\t\tif err != nil {\n\t\t\tif required {","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/ebpf/filetracer/tracer.go#L137-L173","documentation":"During filetracer.New, after loading the eBPF objects the tracer writes the target process name (\"dagger-engine\") into the TargetComm map so the BPF program can filter events to the engine process. `objs.TargetComm.Put(zero, commBytes)` failed — typically a map-update rejection from the BPF layer (invalid map fd, map removed, permission/kernel restriction) — and the constructor closes the objects and wraps the error. It means the tracer could not be initialized and the file tracer is not running.","triggerScenarios":"Calling filetracer.New when the loaded BPF maps are invalid or already closed, the kernel refuses the map update (BPF disabled, locked-down seccomp/LSM, missing CAP_BPF/CAP_SYS_ADMIN in restricted environments), or an fd/resource limit prevents map access.","commonSituations":"Running the engine inside a container without the required BPF capabilities or with /proc/sys/kernel/unprivileged_bpf_disabled and no privileges; kernel older than the map type requires; nested virtualization/CI runners that block bpf() syscalls; objs.Close() raced with Put after a prior init failure.","solutions":["Ensure the engine runs with the required privileges: root or CAP_BPF+CAP_PERFMON (older kernels: CAP_SYS_ADMIN); restart with e.g. `docker run --privileged` or the equivalent capability set.","Check the kernel supports the BPF map type used (upgrade kernel, or verify /proc/sys/kernel/perf_event_paranoid and unprivileged_bpf_disabled settings).","Confirm bpf() isn't blocked by seccomp/LSM policy (gVisor, hardened CI runners) — run on a host that permits BPF syscalls.","Retry after fixing permissions; if New fails partway, objects are closed, so simply call New again rather than reusing the returned object."],"exampleFix":"// before: restricted container\n$ docker run dagger-engine ...\n// error: setting target comm: operation not permitted\n// after\n$ docker run --privileged dagger-engine ...\n// (or) docker run --cap-add=CAP_BPF --cap-add=CAP_PERFMON --cap-add=CAP_SYS_ADMIN ...","handlingStrategy":"try-catch","validationCode":"// Before starting the engine, verify BPF is usable:\n// - running as root or with CAP_BPF/CAP_PERFMON (CAP_SYS_ADMIN on <5.8)\n// - not blocked by seccomp/LSM (gVisor, hardened CI)\n$ cat /proc/sys/kernel/unprivileged_bpf_disabled   # 0 or run privileged\n$ docker run --privileged ...   # if inside a container","typeGuard":null,"tryCatchPattern":"tracer, err := filetracer.New()\nif err != nil {\n  var perr *fmt.WrapError\n  if strings.Contains(err.Error(), \"setting target comm:\") {\n    slog.Warn(\"file tracer unavailable (BPF map update rejected); continuing without tracing\", \"err\", err)\n  } else {\n    return err\n  }\n}","preventionTips":["Run the engine with the BPF capabilities it needs (privileged container or CAP_BPF+CAP_PERFMON)","Verify the host kernel allows bpf() syscalls (no gVisor/seccomp block, sane unprivileged_bpf_disabled)","Check kernel version supports the map types the tracer uses before enabling tracing","Treat file tracing as optional: degrade gracefully when New fails instead of aborting the whole run"],"tags":["ebpf","initialization","permissions","kernel"],"backgroundTag":"bpf-map-update-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}