{"record":{"id":"edcc9739ac19d15f","repo":"hashicorp/nomad","slug":"failed-to-create-socket-mount-point-w","errorCode":null,"errorMessage":"failed to create socket mount point: %w","messagePattern":"failed to create socket mount point: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/plugin_supervisor_hook.go","lineNumber":164,"sourceCode":"\treturn \"csi_plugin_supervisor\"\n}\n\n// Prestart is called before the task is started including after every\n// restart. This requires that the mount paths for a plugin be\n// idempotent, despite us not knowing the name of the plugin ahead of\n// time.  Because of this, we use the allocid_taskname as the unique\n// identifier for a plugin on the filesystem.\nfunc (h *csiPluginSupervisorHook) Prestart(ctx context.Context,\n\treq *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {\n\n\t// Create the mount directory that the container will access if it doesn't\n\t// already exist. Default to only nomad user access.\n\tif err := os.MkdirAll(h.mountPoint, 0700); err != nil && !os.IsExist(err) {\n\t\treturn fmt.Errorf(\"failed to create mount point: %w\", err)\n\t}\n\n\tif err := os.MkdirAll(h.socketMountPoint, 0700); err != nil && !os.IsExist(err) {\n\t\treturn fmt.Errorf(\"failed to create socket mount point: %w\", err)\n\t}\n\n\t// where the socket will be mounted\n\tconfigMount := &drivers.MountConfig{\n\t\tTaskPath:        h.task.CSIPluginConfig.MountDir,\n\t\tHostPath:        h.socketMountPoint,\n\t\tReadonly:        false,\n\t\tPropagationMode: \"bidirectional\",\n\t}\n\t// where the staging and per-alloc directories will be mounted\n\tvolumeStagingMounts := &drivers.MountConfig{\n\t\tTaskPath:        h.task.CSIPluginConfig.StagePublishBaseDir,\n\t\tHostPath:        h.mountPoint,\n\t\tReadonly:        false,\n\t\tPropagationMode: \"bidirectional\",\n\t}\n\t// devices from the host\n\tdevMount := &drivers.MountConfig{","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/plugin_supervisor_hook.go#L146-L182","documentation":"The same Prestart hook also creates h.socketMountPoint (0700) — the host directory where the CSI plugin's socket will be exposed and bind-mounted into the task via MountConfig.HostPath. Failure of os.MkdirAll (other than already-exists) aborts with 'failed to create socket mount point: %w', preventing plugin registration.","triggerScenarios":"os.MkdirAll(h.socketMountPoint, 0700) fails non-IsExist — permission denied, read-only FS, path component is a regular file, container runtime/SELinux restrictions on the socket path","commonSituations":"Stale file at the socket mount path from a previous crashed run, nomad agent running as a different user than before, enforced security modules blocking mkdir under the alloc dir, full or read-only client disk","solutions":["Inspect and fix permissions on the socket mount path's parents so the nomad user can create directories","Delete any non-directory file occupying the path and restart the allocation","Check mount/SELinux status; ensure the filesystem is writable and security policy allows the nomad data dir","Restart the nomad client agent to recreate clean alloc hook state if the path is managed internally"],"exampleFix":"# before\n$ file /var/lib/nomad/alloc/<id>/csi\n /var/lib/nomad/alloc/<id>/csi: ASCII text (stale file)\n# after\n$ sudo rm /var/lib/nomad/alloc/<id>/csi && nomad alloc stop <alloc>","handlingStrategy":"retry","validationCode":"// host-side precheck for socket mount point\nsudo -u nomad test -w \"$(dirname socketMountPoint)\" && echo ok","typeGuard":null,"tryCatchPattern":"// on failure, clean stale path and restart the allocation\nif strings.Contains(err.Error(), \"failed to create socket mount point\") {\n    removeStalePath(); nomadAllocStopRestart()\n}","preventionTips":["Clean up leftover alloc dirs after crashed runs","Ensure consistent nomad agent user across upgrades","Whitelist nomad data dir in SELinux/AppArmor policies","Monitor disk writability on CSI-capable nodes"],"tags":["filesystem","csi","permissions"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}