dagger/dagger · critical

install dnsmasq: %w

Error message

install dnsmasq: %w

What it means

This error wraps a failure from netinst.InstallDnsmasq, which installs/sets up the dnsmasq DHCP/DNS daemon for a Dagger engine network during setupNetwork in the engine's main entrypoint. It indicates dnsmasq could not be installed or configured for the given network (netName). Since setupNetwork runs at engine startup, a failure here aborts engine boot before any builds can run.

Source

Thrown at cmd/engine/main.go:948

	bridge, err := network.BridgeFromCIDR(netCIDR)
	if err != nil {
		return nil, fmt.Errorf("bridge from cidr: %w", err)
	}

	if err := netinst.EnsureIptablesSymlinks(ctx); err != nil {
		return nil, fmt.Errorf("ensure iptables symlinks: %w", err)
	}

	// NB: this is needed for the Dagger shim worker at the moment for host alias
	// resolution
	err = netinst.InstallResolvconf(netName, bridge.String())
	if err != nil {
		return nil, fmt.Errorf("install resolv.conf: %w", err)
	}

	err = netinst.InstallDnsmasq(ctx, netName)
	if err != nil {
		return nil, fmt.Errorf("install dnsmasq: %w", err)
	}

	cniConfigPath, err := netinst.InstallCNIConfig(ctx, netName, netCIDR)
	if err != nil {
		return nil, fmt.Errorf("install cni: %w", err)
	}

	return &networkConfig{
		NetName:       netName,
		NetCIDR:       netCIDR,
		Bridge:        bridge,
		CNIConfigPath: cniConfigPath,
	}, nil
}

View on GitHub (pinned to 82ba2681db)

Solutions

1. Ensure dnsmasq is installed on the host (e.g. apt-get install dnsmasq) and the install command it runs succeeds
2. Run the engine with sufficient privileges (root or CAP_NET_ADMIN/CAP_NET_RAW) so dnsmasq can be set up
3. Check the wrapped error (%w) for the underlying cause (disk full, read-only fs, missing binary) and fix that
4. Verify the root filesystem is writable where dnsmasq config/binary are installed

Example fix

// before: engine run in unprivileged container fails at boot
// after: grant network capabilities or pre-install dnsmasq in the image
//   Dockerfile: RUN apt-get update && apt-get install -y dnsmasq
//   run: docker run --cap-add NET_ADMIN --cap-add NET_RAW ...

// before starting the engine, verify dnsmasq availability and privileges
if _, err := exec.LookPath("dnsmasq"); err != nil {
    return fmt.Errorf("dnsmasq not installed: %w", err)
}
if os.Geteuid() != 0 { /* or check CAP_NET_ADMIN */
    return errors.New("engine network setup requires root/CAP_NET_ADMIN")
}

if _, err := setupNetwork(...); err != nil {
    var wrapped *fmt.wrapError
    if errors.As(err, &wrapped) {
        log.Printf("network setup failed: %v", wrapped.Unwrap())
    }
    // fail fast: engine cannot run without its network
}

When it happens

Trigger: Engine startup calls setupNetwork -> InstallDnsmasq(ctx, netName) which returns a non-nil error (e.g. binary missing, package manager failure, permission denied writing config, or network setup failure).

Common situations: Running the engine in a minimal container without dnsmasq available or installable; missing root/CAP_NET_ADMIN privileges to configure networking; read-only root filesystem preventing dnsmasq config installation; corrupted or unsupported network name.

Related errors

• install cni: %w
• write dnsmasq.conf: %w
• start dnsmasq: %w
• bridge from cidr: %w
• ensure iptables symlinks: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/5f45778d418f392e. Report an issue: GitHub.