{"record":{"id":"fa1f6435b7b3f471","repo":"dagger/dagger","slug":"working-dir-s-points-to-invalid-target-w","errorCode":null,"errorMessage":"working dir %s points to invalid target: %w","messagePattern":"working dir (.+?) points to invalid target: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/engineutil/executor_spec.go","lineNumber":1051,"sourceCode":"\t//nolint:staticcheck\n\tstate.spec.Hooks.Prestart = append(state.spec.Hooks.Prestart, specs.Hook{\n\t\tArgs: []string{\n\t\t\t\"nvidia-container-runtime-hook\",\n\t\t\t\"prestart\",\n\t\t},\n\t\tPath: \"/usr/bin/nvidia-container-runtime-hook\",\n\t})\n\tstate.spec.Process.Env = append(state.spec.Process.Env, fmt.Sprintf(\"NVIDIA_VISIBLE_DEVICES=%s\",\n\t\tstrings.Join(state.execMD.EnabledGPUs, \",\"),\n\t))\n\n\treturn nil\n}\n\nfunc (c *Client) createCWD(_ context.Context, state *execState) error {\n\tnewp, err := fs.RootPath(state.rootfsPath, state.procInfo.Meta.Cwd)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"working dir %s points to invalid target: %w\", newp, err)\n\t}\n\tif _, err := os.Stat(newp); err != nil {\n\t\tif err := user.MkdirAllAndChown(newp, 0o755, int(state.uid), int(state.gid), user.WithOnlyNew); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create working directory %s: %w\", newp, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (c *Client) setupNestedClient(ctx context.Context, state *execState) (rerr error) {\n\tif state.nestedClientMetadata == nil || state.nestedClientMetadata.ClientID == \"\" {\n\t\treturn nil\n\t}\n\n\tif state.nestedClientMetadata.ClientSecretToken == \"\" {\n\t\tstate.nestedClientMetadata.ClientSecretToken = randid.NewID()\n\t}","sourceCodeStart":1033,"sourceCodeEnd":1069,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/engineutil/executor_spec.go#L1033-L1069","documentation":"Before starting the process, the container's working directory (procInfo.Meta.Cwd) is resolved against the rootfs with fs.RootPath. If resolution fails - typically because the Cwd escapes the rootfs via '..' or is invalid - exec setup fails with 'working dir %s points to invalid target'.","triggerScenarios":"Container.WithWorkdir (or Workspace/dir defaults) set a Cwd that fs.RootPath(rootfsPath, cwd) rejects, e.g. '/..', a path climbing above '/', or a malformed path.","commonSituations":"Passing user-supplied or computed workdir strings containing '..'; building images whose default WORKDIR interacts badly with path normalization; typos like '///' with traversals in WithWorkdir.","solutions":["Fix the workdir passed to WithWorkdir so it is a clean absolute path inside the container (e.g. /src/app, not /src/../..)","Normalize the path before passing it (path.Clean / strip leading '..' segments)","Check upstream directory/GitRef sources for paths that include '..' segments","Pin/upgrade Dagger if a legitimate path is rejected - RootPath semantics changed historically"],"exampleFix":"// before\nctr.WithWorkdir(\"/src/../..\")\n// after\nctr.WithWorkdir(\"/src\")","handlingStrategy":"validation","validationCode":"func validWorkdir(wd string) bool {\n    if !filepath.IsAbs(wd) { return false }\n    return !strings.Contains(filepath.Clean(wd), \"..\")\n}\n// call before WithWorkdir\nif !validWorkdir(wd) { return fmt.Errorf(\"invalid workdir %q\", wd) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass clean absolute workdirs to WithWorkdir","Sanitize any user-supplied workdir against '..' segments","Derive workdirs from known constants, not concatenated strings"],"tags":["workdir","filesystem","path-resolution"],"backgroundTag":"path-escapes-rootfs","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}