{"record":{"id":"ffea91f37baf31c2","repo":"hashicorp/nomad","slug":"error-chowning-file-w","errorCode":null,"errorMessage":"error chowning file %w","messagePattern":"error chowning file %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocwatcher/alloc_watcher.go","lineNumber":666,"sourceCode":"\t\t\t\t\treturn fmt.Errorf(\"error removing existing file: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tf, err := os.Create(fPath)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error creating file: %w\", err)\n\t\t\t}\n\n\t\t\t// Setting the permissions of the file as the origin.\n\t\t\tif err := f.Chmod(os.FileMode(hdr.Mode)); err != nil {\n\t\t\t\tf.Close()\n\t\t\t\treturn fmt.Errorf(\"error chmoding file %w\", err)\n\t\t\t}\n\n\t\t\t// Can't change owner if not root or on Windows.\n\t\t\tif euid == 0 {\n\t\t\t\tif err := f.Chown(hdr.Uid, hdr.Gid); err != nil {\n\t\t\t\t\tf.Close()\n\t\t\t\t\treturn fmt.Errorf(\"error chowning file %w\", err)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// We write in chunks so that we can test if the client\n\t\t\t// is still alive\n\t\t\tfor !canceled() {\n\t\t\t\tn, err := tr.Read(buf)\n\t\t\t\tif n > 0 && (err == nil || err == io.EOF) {\n\t\t\t\t\tif _, err := f.Write(buf[:n]); err != nil {\n\t\t\t\t\t\tf.Close()\n\t\t\t\t\t\treturn fmt.Errorf(\"error writing to file %q: %w\", f.Name(), err)\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif err != nil {\n\t\t\t\t\tf.Close()\n\t\t\t\t\tif err != io.EOF {\n\t\t\t\t\t\treturn fmt.Errorf(\"error reading snapshot: %w\", err)","sourceCodeStart":648,"sourceCodeEnd":684,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocwatcher/alloc_watcher.go#L648-L684","documentation":"In streamAllocDir, f.Chown(hdr.Uid, hdr.Gid) failed while restoring ownership of a migrated file. This branch only runs when euid==0 (root, non-Windows), so the failure means the tarred uid/gid could not be applied on the destination filesystem.","triggerScenarios":"Running as root, streamAllocDir extracts a TypeReg entry and f.Chown(hdr.Uid, hdr.Gid) returns an error (invalid uid/gid, unsupported filesystem, missing capability in container).","commonSituations":"Containerized root without CAP_CHOWN; root-squashed NFS or other network filesystems; tar headers with Uid/Gid that do not exist on the destination host.","solutions":["Grant CAP_CHOWN to the Nomad client container or run it on the host directly","Verify the destination filesystem supports chown (avoid root-squashed NFS for the data dir)","Re-snapshot the alloc dir so headers carry Uid/Gid valid on the destination host","Run the client as non-root to skip the chown step if ownership preservation is not required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// When running as root in a container, verify CAP_CHOWN before enabling migration:\n// f, _ := os.Create(probe); err := f.Chown(1000, 1000); if err != nil { capability missing }","typeGuard":null,"tryCatchPattern":"if err := watcher.Wait(ctx); err != nil {\n    if strings.Contains(err.Error(), \"error chowning file\") {\n        // fix capabilities/filesystem or run client unprivileged (skips chown)\n        return err\n    }\n    return err\n}","preventionTips":["Grant CAP_CHOWN to root-run Nomad client containers","Avoid root-squashed NFS for the client data dir","Keep UID/GID mappings consistent across cluster nodes"],"tags":["nomad","filesystem","chown","permissions"],"backgroundTag":"chown-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}