{"record":{"id":"fdb60cab76ebb8d0","repo":"jdx/mise","slug":"refusing-unsafe-change-to-bootstrap-service","errorCode":null,"errorMessage":"refusing unsafe change to bootstrap service '{}'; inspect `mise bootstrap plan`","messagePattern":"refusing unsafe change to bootstrap service '(.+?)'; inspect `mise bootstrap plan`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/services.rs","lineNumber":376,"sourceCode":"                state: self.state,\n                enabled: self.enabled,\n                masked: self.masked,\n                on_change: self.on_change,\n                dependency_changed,\n                notified,\n                active: self.is_active(),\n            })),\n            ResourceAction::Unknown if change.provides_unit && missing => Ok(Some(ServiceAction {\n                unit: self.unit.clone(),\n                state: self.state,\n                enabled: self.enabled,\n                masked: self.masked,\n                on_change: self.on_change,\n                dependency_changed,\n                notified,\n                active: false,\n            })),\n            ResourceAction::Unknown => bail!(\n                \"refusing unsafe change to bootstrap service '{}'; inspect `mise bootstrap plan`\",\n                self.name\n            ),\n            ResourceAction::Create | ResourceAction::Remove => {\n                unreachable!(\"service lifecycle requests do not create or remove units\")\n            }\n        }\n    }\n\n    fn from_action(action: &ServiceAction) -> Self {\n        Self {\n            name: action.unit.clone(),\n            unit: action.unit.clone(),\n            state: action.state,\n            enabled: action.enabled,\n            masked: action.masked,\n            on_change: action.on_change,\n            origin: None,","sourceCodeStart":358,"sourceCodeEnd":394,"githubUrl":"https://github.com/jdx/mise/blob/6f52dcdf99e282ef7a7db68c81301fa4618d0f79/src/system/services.rs#L358-L394","documentation":"mise refuses to compute an apply action for a `[bootstrap.services]` entry whose plan resolves to `ResourceAction::Unknown`. Unknown means the current systemd state could not be determined safely: the service was never inspected (systemctl missing), the unit file does not exist and no managed file provides it, or the unit cannot be enabled in its current unit-file state (e.g. `static`). mise deliberately fails instead of issuing blind systemctl commands against a service it cannot see.","triggerScenarios":"Running `mise bootstrap apply` (directly or via the elevated helper) for a service where: systemctl is not on PATH (inspection Unavailable); the unit is Missing and `provides_unit` is false (no `[[bootstrap.files]]` entry supplies the unit file); or the plan set enabled=true but the existing unit-file state is not enableable (static/indirect/bad).","commonSituations":"Typo'd service name so the unit does not exist on the host; container or minimal VM without a running systemd/systemctl; referencing a unit shipped by a package that is not installed yet; vendored unit installed as `static` while config asks for enabled=true.","solutions":["Run `mise bootstrap plan` and read the `current` column for the failing service to see why inspection failed","Fix the service name typo or install the package that ships the unit","If the unit is managed by you, add it under `[[bootstrap.files]]` with `path = \"/etc/systemd/system/<name>.service\"` so the plan sees `provides_unit`","Ensure systemctl exists and systemd runs as PID 1 (bare containers/WSL without systemd hit this)","If the unit-file state is static, align the config (`enabled = false`) or use the supported enable mechanism for that unit"],"exampleFix":"# before\n[bootstrap.services.myapp]\nenabled = true\n# unit /etc/systemd/system/myapp.service does not exist -> Unknown\n\n# after\n[[bootstrap.files]]\npath = \"/etc/systemd/system/myapp.service\"\nexec = \"#!/bin/sh\\nexec /usr/local/bin/myapp\\n\"\n\n[bootstrap.services.myapp]\nenabled = true","handlingStrategy":"validation","validationCode":"mise bootstrap plan --json 2>/dev/null | jq -r '.services[] | select(.action == \"unknown\") | .id'\n# any output = entries that will hit the refusal; fix them before apply","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run `mise bootstrap plan` before `apply` and treat any `unknown` action as a blocker","Declare every referenced unit under `[[bootstrap.files]]` so missing-unit cases become provide-and-update instead of unknown","Never assume systemctl exists: check `command -v systemctl` in container/CI images that will run bootstrap apply"],"tags":["mise","bootstrap","systemd","systemctl","plan"],"backgroundTag":"refuse-unsafe-state-change","analyzedSha":"6f52dcdf99e282ef7a7db68c81301fa4618d0f79","analyzedAt":"2026-08-22T10:14:23.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}