dagger/dagger · error

calling snapshotter.Remove is forbidden

Error message

calling snapshotter.Remove is forbidden

What it means

The nsSnapshotter wrapper overrides Remove to always return 'calling snapshotter.Remove is forbidden'. Deleting snapshots directly from the containerd snapshotter would corrupt buildkit's own cache/reference accounting, so the operation is intentionally blocked and any call is a contract violation.

Source

Thrown at engine/snapshots/containerd/snapshotter.go:62

}

func (s *nsSnapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
	ctx = namespaces.WithNamespace(ctx, s.ns)
	return s.Snapshotter.Prepare(ctx, key, parent, opts...)
}

func (s *nsSnapshotter) View(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
	ctx = namespaces.WithNamespace(ctx, s.ns)
	return s.Snapshotter.View(ctx, key, parent, opts...)
}

func (s *nsSnapshotter) Commit(ctx context.Context, name, key string, opts ...snapshots.Opt) error {
	ctx = namespaces.WithNamespace(ctx, s.ns)
	return s.Snapshotter.Commit(ctx, name, key, opts...)
}

func (s *nsSnapshotter) Remove(ctx context.Context, key string) error {
	return errors.Errorf("calling snapshotter.Remove is forbidden")
}

func (s *nsSnapshotter) Walk(ctx context.Context, fn snapshots.WalkFunc, filters ...string) error {
	ctx = namespaces.WithNamespace(ctx, s.ns)
	return s.Snapshotter.Walk(ctx, fn, filters...)
}

type fromContainerd struct {
	name string
	snapshots.Snapshotter
}

func (s *fromContainerd) Name() string {
	return s.name
}

func (s *fromContainerd) Mounts(ctx context.Context, key string) (bksnapshots.MountableRef, error) {
	mounts, err := s.Snapshotter.Mounts(ctx, key)

View on GitHub (pinned to 82ba2681db)

Solutions

1. Remove the call — snapshot removal must go through buildkit's cache manager, not the raw snapshotter.
2. Use the cache manager's Release/prune APIs so references are tracked correctly.
3. If cleanup is required out-of-band, understand snapshot keys may still be referenced and cause corruption.

Example fix

// before
if err := sn.Remove(ctx, key); err != nil { return err }
// after
// release via the cache manager instead
cm.Release(ctx, ref)

// never call Remove on the wrapped snapshotter
// audit code for `snapshotter.Remove(` / `sn.Remove(` before shipping

When it happens

Trigger: Any code calling nsSnapshotter.Remove(ctx, key) — e.g. custom cleanup of snapshot keys, or migrated buildkit code assuming a standard snapshotter interface.

Common situations: Cleanup scripts or extensions trying to delete stale snapshot keys; porting code that uses a raw containerd snapshotter to this wrapper; manual GC implementations.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• contentstore.Delete usage is forbidden
• prepare mounts: %w
• protect service mount snapshot %s: %w
• failed to check for changes: %w
• get rootfs mount: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/2decb0010344fb4d. Report an issue: GitHub.