{"record":{"id":"e768f02cdf49f8ec","repo":"Billionmail/BillionMail","slug":"failed-to-start-temporary-container-w","errorCode":null,"errorMessage":"failed to start temporary container: %w","messagePattern":"failed to start temporary container: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/internal/service/dockerapi/dockerapi.go","lineNumber":327,"sourceCode":"\n\t// Create temporary container\n\tresp, err := d.client.ContainerCreate(\n\t\tctx,\n\t\tconfig,\n\t\thostConfig,\n\t\tnil,\n\t\tnil,\n\t\t\"\",\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create temporary container: %w\", err)\n\t}\n\tcontainerID := resp.ID\n\tdefer d.cleanupContainer(ctx, containerID) // Ensure container is cleaned up\n\n\t// Start container\n\tif err := d.client.ContainerStart(ctx, containerID, container.StartOptions{}); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to start temporary container: %w\", err)\n\t}\n\n\t// Wait for container execution to complete\n\tstatusCh, errCh := d.client.ContainerWait(ctx, containerID, container.WaitConditionNotRunning)\n\tselect {\n\tcase err := <-errCh:\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed waiting for container execution: %w\", err)\n\t\t}\n\tcase status := <-statusCh:\n\t\tresult.ExitCode = int(status.StatusCode)\n\t}\n\n\t// Get container logs\n\toptions := container.LogsOptions{\n\t\tShowStdout: true,\n\t\tShowStderr: true,\n\t}","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/service/dockerapi/dockerapi.go#L309-L345","documentation":"After successfully creating the temporary container, ExecHostCommand calls client.ContainerStart to run it; any failure there is wrapped as this error. The container exists at this point (and is cleaned up via the deferred cleanupContainer), but could not be started. Start failures are typically runtime/environment level rather than API-structure level.","triggerScenarios":"ContainerStart fails after ContainerCreate succeeded: image entrypoint/cmd rejected at runtime (e.g. command binary not present in alpine image), runtime errors like runc failures, port/network conflicts with NetworkMode host, cgroup or namespace permission errors, or the container being removed concurrently.","commonSituations":"Passing a command whose binary doesn't exist in alpine (e.g. bash instead of sh); AppArmor/SELinux denying privileged start; kernel lacking required features; Docker daemon's containerd shim crashing; stale container ID race when callers overlap.","solutions":["Inspect the wrapped error and containerd/runc logs (journalctl -u docker) for the runtime failure reason","Verify the command array's first element is an executable present in alpine:latest (use /bin/sh, not bash)","Test manually: docker run --rm --privileged -v /:/host_root -w /host_root --network host alpine <cmd>","Restart Docker / check kernel cgroup v2 support if the failure is runc-related"],"exampleFix":"// before\nif err := d.client.ContainerStart(ctx, containerID, container.StartOptions{}); err != nil {\n\treturn nil, fmt.Errorf(\"failed to start temporary container: %w\", err)\n}\n// after\nif err := d.client.ContainerStart(ctx, containerID, container.StartOptions{}); err != nil {\n\treturn nil, fmt.Errorf(\"failed to start temporary container %s (cmd=%v): %w\", containerID[:12], command, err)\n}","handlingStrategy":"try-catch","validationCode":"// verify the command exists inside the base image before starting\nif _, err := d.client.ContainerInspect(ctx, containerID); err != nil {\n\treturn fmt.Errorf(\"container not inspectable before start: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"res, err := docker.ExecHostCommand(ctx, cmd)\nif err != nil && strings.Contains(err.Error(), \"failed to start temporary container\") {\n\t// runtime/start failure: check daemon + command binary, then retry once\n\tlogger.Error(\"container start failed\", \"err\", err)\n}","preventionTips":["Use commands guaranteed present in alpine (/bin/sh), never bash","Test the exact privileged bind-mount docker run command manually first","Keep SELinux/AppArmor profiles permissive for the daemon's bind of /","Avoid concurrent duplicate ExecHostCommand calls that could race container state"],"tags":["docker","container-start","devops"],"backgroundTag":"docker-container-start-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}