{"record":{"id":"f0e6a44ae3fa2189","repo":"hashicorp/nomad","slug":"chmod-v-failed-w","errorCode":null,"errorMessage":"Chmod(%v) failed: %w","messagePattern":"Chmod\\((.+?)\\) failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocdir/fs_unix.go","lineNumber":38,"sourceCode":"var (\n\t// SharedAllocContainerPath is the path inside container for mounted\n\t// directory shared across tasks in a task group.\n\tSharedAllocContainerPath = filepath.Join(\"/\", SharedAllocName)\n\n\t// TaskLocalContainerPath is the path inside a container for mounted directory\n\t// for local storage.\n\tTaskLocalContainerPath = filepath.Join(\"/\", TaskLocal)\n\n\t// TaskSecretsContainerPath is the path inside a container for mounted\n\t// secrets directory\n\tTaskSecretsContainerPath = filepath.Join(\"/\", TaskSecrets)\n)\n\n// dropDirPermissions gives full access to a directory to all users and sets\n// the owner to nobody.\nfunc dropDirPermissions(path string, desired os.FileMode) error {\n\tif err := os.Chmod(path, desired|fileMode777); err != nil {\n\t\treturn fmt.Errorf(\"Chmod(%v) failed: %w\", path, err)\n\t}\n\n\t// Can't change owner if not root.\n\tif unix.Geteuid() != 0 {\n\t\treturn nil\n\t}\n\n\tu, err := users.Lookup(\"nobody\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Unable to find nobody user: %w\", err)\n\t}\n\n\tuid, err := getUid(u)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tgid, err := getGid(u)","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocdir/fs_unix.go#L20-L56","documentation":"dropDirPermissions attempts os.Chmod(path, desired|0777) to give all users full access to a shared allocation directory (typically the shared alloc dir exposed to chroot-isolated tasks). This error means the chmod syscall failed; the wrapped error carries the OS reason, usually EPERM because the process does not own the directory.","triggerScenarios":"os.Chmod(path, desired|fileMode777) returned an error while relaxing permissions on a built alloc/task directory, e.g. during task directory Build for chroot filesystem isolation.","commonSituations":"Directory owned by another user (stale alloc dirs from a previous run under a different client user); read-only mounts; alloc-dir on a filesystem not supporting chmod (some FAT/overlay setups); immutable attribute set.","solutions":["Ensure the Nomad client process owns the alloc directory (chown -R the data_dir to the client user).","Clean stale alloc dirs from previous runs: nomad system gc or manually remove client data_dir/alloc.","Check that the alloc-dir mount is writable and supports chmod.","Inspect the wrapped error (lsattr, mount options) if permissions look correct."],"exampleFix":"// before: client running as unprivileged user with root-owned alloc dir\nExecStart=/usr/bin/nomad agent -config /etc/nomad.d\n// after: run client as a dedicated user that owns data_dir\nchown -R nomad:nomad /var/lib/nomad\nExecStart=/usr/bin/nomad agent -config /etc/nomad.d\nUser=nomad","handlingStrategy":"validation","validationCode":"// preflight: client must own the alloc dir and be able to chmod\nif st, err := os.Stat(allocDir); err != nil {\n    return err\n} else if st.Mode().Perm()&0o200 == 0 {\n    return fmt.Errorf(\"alloc dir %s not writable by client user\", allocDir)\n}\n// test:\nprobe := filepath.Join(allocDir, \".chmod-probe\")\nos.WriteFile(probe, nil, 0o600)\nerr := os.Chmod(probe, 0o700); os.Remove(probe)","typeGuard":null,"tryCatchPattern":"if err := buildTaskDir(...); err != nil {\n    var eperm syscall.Errno\n    if errors.As(err, &eperm) && eperm == syscall.EPERM {\n        log.Printf(\"chmod denied on %s; check ownership\", allocDir)\n    }\n    return err\n}","preventionTips":["Provision data_dir owned by the Nomad client user from the start.","Do not run the client as a different user across upgrades without chowning data_dir.","Keep alloc dirs off read-only or unusual filesystems."],"tags":["filesystem","permissions","chmod","nomad"],"backgroundTag":"chmod-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}