{"record":{"id":"d143f9e4c6ac2457","repo":"hashicorp/nomad","slug":"failed-to-chown-task-mount-directory-v","errorCode":null,"errorMessage":"Failed to chown task mount directory: %v","messagePattern":"Failed to chown task mount directory: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocdir/task_dir.go","lineNumber":195,"sourceCode":"\t// Only bind mount the task alloc/task dirs to the client.mounts_dir/<task>\n\tif fsi == fsisolation.Unveil {\n\t\tuid, gid, _, err := dynamic.LookupUser(username)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup user: %v\", err)\n\t\t}\n\n\t\tnobodyUID, nobodyGID, _, err := dynamic.LookupUser(\"nobody\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup nobody user: %v\", err)\n\t\t}\n\n\t\t// create the task unique directory under the client mounts path\n\t\tparent := filepath.Dir(t.MountsAllocDir)\n\t\tif err = os.MkdirAll(parent, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to create task mount directory: %v\", err)\n\t\t}\n\t\tif err = os.Chown(parent, uid, gid); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to chown task mount directory: %v\", err)\n\t\t}\n\n\t\t// create the taskdir mount point\n\t\tif err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount task dir: %v\", err)\n\t\t}\n\n\t\t// create the allocdir mount point (owned by nobody)\n\t\tif err = mountDir(filepath.Join(t.AllocDir, \"/alloc\"), t.MountsAllocDir, nobodyUID, nobodyGID, fileMode777); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount alloc dir: %v\", err)\n\t\t}\n\n\t\t// create the secretsdir mount point\n\t\tif err = mountDir(t.SecretsDir, t.MountsSecretsDir, uid, gid, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount secrets dir: %v\", err)\n\t\t}\n\t}\n","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocdir/task_dir.go#L177-L213","documentation":"After creating the per-task mounts directory in Unveil mode, TaskDir.Build runs os.Chown(parent, uid, gid) so the task's runtime user owns it. This error wraps a chown failure. Nomad needs this ownership so the isolated task can traverse its mount points.","triggerScenarios":"os.Chown fails during TaskDir.Build(Unveil) — typically because the Nomad client process is not root (or lacks CAP_CHOWN) while the target uid/gid differ from its own, or the parent directory just created has restrictive ownership.","commonSituations":"Running nomad agent as a non-root user with Unveil/task isolation; containerized Nomad client dropped privileges (no CAP_CHOWN); root-squashed NFS-mounted data_dir where chown to another uid is denied (EPERM).","solutions":["Run the Nomad client as root (or with CAP_CHOWN / CAP_DAC_OVERRIDE capability set)","Check the wrapped errno: EPERM on NFS → move data_dir off root-squashed NFS to local storage","If non-root operation is required, switch the task driver/fs-isolation mode that doesn't require chown (chroot as the same user)","Confirm the resolved task username exists and the intended uid/gid are correct in the agent logs"],"exampleFix":"// before: systemd unit runs nomad as non-root\nUser=nomad\n# after\nUser=root\n# or drop-in override with capability\n[Service]\nAmbientCapabilities=CAP_CHOWN CAP_DAC_OVERRIDE","handlingStrategy":"validation","validationCode":"// ensure the process can chown: must be root or have CAP_CHOWN\nif os.Geteuid() != 0 {\n    log.Fatal(\"Unveil fs isolation requires running the Nomad client as root (CAP_CHOWN)\")\n}","typeGuard":null,"tryCatchPattern":"if err := taskDir.Build(fsi, chroot, username); err != nil {\n    var perr *os.PathError\n    if errors.As(err, &perr) && errors.Is(perr.Err, syscall.EPERM) {\n        return fmt.Errorf(\"chown denied (EPERM): run client as root or grant CAP_CHOWN; avoid root-squashed NFS for data_dir: %w\", err)\n    }\n    return err\n}","preventionTips":["Run nomad agent as root when using Unveil/task isolation","If containerized, add CAP_CHOWN to the container capability set","Avoid root-squashed NFS for data_dir","Verify ownership requirements after distro/upgrade changes"],"tags":["permissions","chown","nomad-client"],"backgroundTag":"chown-operation-not-permitted","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}