dagger/dagger · error

mount meta mount: %w

Error message

mount meta mount: %w

What it means

This error wraps a failure from containerd's mount.All() while mounting the 'meta mount' (the Dagger scratch/communication mount used to pass exit codes between executor and container) at a temporary directory during setupRootfs. The meta mount is only mounted into a temp dir when it is not a bind/rbind mount; any kernel/syscall-level mount failure (unsupported fs type, missing privileges, missing source) surfaces here. It is a low-level mount(2) failure raised by the Dagger executor before the container starts.

Source

Thrown at engine/engineutil/executor_spec.go:538

	if metaMount != nil {
		switch metaMount.Type {
		case "bind", "rbind":
			state.metaMountDirPath = metaMount.Source
		default:
			mntPath, err := os.MkdirTemp("", "meta-mount")
			if err != nil {
				return fmt.Errorf("create meta mount temp dir: %w", err)
			}
			state.cleanups.Add("remove meta mount temp dir", func() error {
				return os.RemoveAll(mntPath)
			})
			mnts := []mount.Mount{{
				Type:    metaMount.Type,
				Source:  metaMount.Source,
				Options: metaMount.Options,
			}}
			if err := mount.All(mnts, mntPath); err != nil {
				return fmt.Errorf("mount meta mount: %w", err)
			}
			state.cleanups.Add("unmount meta mount", func() error {
				return mount.UnmountMounts(mnts, mntPath, 0)
			})
			state.metaMountDirPath = mntPath
		}
	}

	state.cleanups.Add("cleanup rootfs stubs", cleanups.Infallible(executor.MountStubsCleaner(
		ctx,
		state.rootfsPath,
		state.mounts,
		state.procInfo.Meta.RemoveMountStubsRecursive,
	)))

	for _, mnt := range state.nonRootMounts {
		mnt, recursiveReadOnly := consumeRecursiveReadOnlyOption(mnt)
		dstPath, err := fs.RootPath(state.spec.Root.Path, mnt.Target)

View on GitHub (pinned to 82ba2681db)

Solutions

1. Verify the executor process has CAP_SYS_ADMIN / runs in a privileged context so mount(2) is permitted
2. Check that the meta mount source path exists and is of the expected type (ls -la on the source)
3. Confirm the kernel supports the requested mount type and options (try the mount manually)
4. Restart the engine/recreate its scratch state to clear corrupted meta mount sources
5. Collect the wrapped inner error (%w) for the actual syscall errno and address that specifically

Example fix

// before (engine run unprivileged in nested container)
$ docker run ... dagger-engine  # mount meta mount: permission denied
// after
$ docker run --privileged ... dagger-engine  # or a container runtime config granting CAP_SYS_ADMIN

if !hasCapSysAdmin() { return errors.New("executor needs CAP_SYS_ADMIN to mount meta mount; run privileged") }
if _, err := os.Stat(metaMountSource); err != nil { return fmt.Errorf("meta mount source missing: %w", err) }

if err := client.Container().From(alpine).Sync(ctx); err != nil {
	var meta *fs.PathError
	if strings.Contains(err.Error(), "mount meta mount") {
		// engine lacks privileges or scratch state corrupted; restart engine privileged
	}
}

When it happens

Trigger: setupRootfs encounters a spec.Mounts entry whose Destination is MetaMountDestPath with a non-bind type (e.g. overlay/tmpfs) and mount.All fails: the mount source doesn't exist, the filesystem type is unsupported by the kernel, options are invalid, or the process lacks CAP_SYS_ADMIN.

Common situations: Running the engine in a restricted container/VM (Docker-in-Docker, sandboxed CI) without mount privileges; a corrupted or removed scratch source directory; kernel without support for the requested mount type; leftover stale state after an engine upgrade.

Related errors

• mkdir %s: %w
• open combined output file: %w
• mount before to ./a/: %w
• mount after to ./b/: %w
• copy changed paths: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/8be5cc14af27e709. Report an issue: GitHub.