{"record":{"id":"d49a39866c5af3b5","repo":"google-gemini/gemini-cli","slug":"failed-to-mount-workspace-into-lxc-container-co","errorCode":null,"errorMessage":"Failed to mount workspace into LXC container '${containerName}': ${err instanceof Error ? err.message : String(err)}","messagePattern":"Failed to mount workspace into LXC container '(.+?)': (.+?)","errorType":"exception","errorClass":"FatalSandboxError","httpStatus":null,"severity":"error","filePath":"packages/cli/src/utils/sandbox.ts","lineNumber":1005,"sourceCode":"    )}`;\n    devicesToRemove.push(workspaceDeviceName);\n\n    try {\n      await execFileAsync('lxc', [\n        'config',\n        'device',\n        'add',\n        containerName,\n        workspaceDeviceName,\n        'disk',\n        `source=${workdir}`,\n        `path=${workdir}`,\n      ]);\n      debugLogger.log(\n        `mounted workspace '${workdir}' into container as device '${workspaceDeviceName}'`,\n      );\n    } catch (err) {\n      throw new FatalSandboxError(\n        `Failed to mount workspace into LXC container '${containerName}': ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n\n    // Add custom allowed paths from config\n    if (config.allowedPaths) {\n      for (const hostPath of config.allowedPaths) {\n        if (hostPath && path.isAbsolute(hostPath) && fs.existsSync(hostPath)) {\n          const allowedDeviceName = `gemini-allowed-${randomBytes(4).toString(\n            'hex',\n          )}`;\n          devicesToRemove.push(allowedDeviceName);\n          try {\n            await execFileAsync('lxc', [\n              'config',\n              'device',\n              'add',\n              containerName,","sourceCodeStart":987,"sourceCodeEnd":1023,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/utils/sandbox.ts#L987-L1023","documentation":"Thrown when `lxc config device add` fails while bind-mounting the host workspace directory into the LXC container as a disk device. The underlying lxc error message is embedded. This is a privileged filesystem operation that can fail for permissions, path, or LXD configuration reasons.","triggerScenarios":"The spawnSync('lxc', ['config','device','add', containerName, workspaceDeviceName, 'disk', `source=${workdir}`, `path=${workdir}`]) call throws — caught by the surrounding try/catch and rethrown as FatalSandboxError.","commonSituations":"workdir is on a filesystem LXD cannot share (e.g. certain network/shiftfs setups). Permission mismatch between host UID and container UID (idmap issues). Container is read-only or restricted by LXD security policy. Path contains characters lxc rejects. LXD storage pool full.","solutions":["Run the failing command manually to see the full lxc error: `lxc config device add <containerName> test disk source=<workdir> path=<workdir>`.","Fix idmap/UID mapping: ensure your user is in the lxd group and `lxc config set <containerName> raw.idmap ...` if needed.","Move the workspace to a filesystem LXD supports (ext4/btrfs/zfs), or use a Docker sandbox backend instead.","Free space on the LXD storage pool if the error indicates a space issue."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const { execFileSync } = require('child_process');\nconst path = require('path');\nfunction dryRunMount(containerName, workdir) {\n  // Probe the mount command before the sandbox uses it.\n  execFileSync('lxc', ['config','device','add', containerName, 'probe', 'disk', `source=${workdir}`, `path=${workdir}`], {stdio:'pipe'});\n  execFileSync('lxc', ['config','device','remove', containerName, 'probe'], {stdio:'pipe'});\n}","typeGuard":null,"tryCatchPattern":"try {\n  await mountWorkspace(containerName, workdir);\n} catch (e) {\n  if (e instanceof FatalSandboxError && /Failed to mount workspace/.test(e.message)) {\n    // inspect lxc error, fix idmap/permissions, then retry or fall back to docker backend\n  } else throw e;\n}","preventionTips":["Configure raw.idmap so host UIDs map cleanly into the container.","Keep the workspace on a filesystem LXD supports (ext4/btrfs/zfs)."],"tags":["sandbox","lxc","lxd","mount","filesystem","permissions"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}