dagger/dagger · error

setting target comm: %w

Error message

setting target comm: %w

What it means

During filetracer.New, after loading the eBPF objects the tracer writes the target process name ("dagger-engine") into the TargetComm map so the BPF program can filter events to the engine process. `objs.TargetComm.Put(zero, commBytes)` failed — typically a map-update rejection from the BPF layer (invalid map fd, map removed, permission/kernel restriction) — and the constructor closes the objects and wraps the error. It means the tracer could not be initialized and the file tracer is not running.

Source

Thrown at engine/ebpf/filetracer/tracer.go:155

func New() (dagebpf.Tracer, error) {
	if err := ebpfutil.Prepare(); err != nil {
		return nil, err
	}

	// Load BPF objects
	var objs fileopsObjects
	if err := loadFileopsObjects(&objs, nil); err != nil {
		return nil, ebpfutil.WrapVerifierError(err, "loading BPF objects")
	}

	// Set target comm (process name) to filter by
	targetComm := "dagger-engine"
	var commBytes [16]byte
	copy(commBytes[:], targetComm)
	zero := uint32(0)
	if err := objs.TargetComm.Put(zero, commBytes); err != nil {
		objs.Close()
		return nil, fmt.Errorf("setting target comm: %w", err)
	}

	slog.Debug("filetracer: targeting process", "comm", targetComm)

	var links []link.Link

	cleanup := func() {
		for _, l := range links {
			l.Close()
		}
		objs.Close()
	}

	// Helper to attach a tracepoint
	attachTP := func(name string, prog *ebpf.Program, required bool) error {
		l, err := link.Tracepoint("syscalls", name, prog, nil)
		if err != nil {
			if required {

View on GitHub (pinned to 82ba2681db)

Solutions

1. Ensure the engine runs with the required privileges: root or CAP_BPF+CAP_PERFMON (older kernels: CAP_SYS_ADMIN); restart with e.g. `docker run --privileged` or the equivalent capability set.
2. Check the kernel supports the BPF map type used (upgrade kernel, or verify /proc/sys/kernel/perf_event_paranoid and unprivileged_bpf_disabled settings).
3. Confirm bpf() isn't blocked by seccomp/LSM policy (gVisor, hardened CI runners) — run on a host that permits BPF syscalls.
4. Retry after fixing permissions; if New fails partway, objects are closed, so simply call New again rather than reusing the returned object.

Example fix

// before: restricted container
$ docker run dagger-engine ...
// error: setting target comm: operation not permitted
// after
$ docker run --privileged dagger-engine ...
// (or) docker run --cap-add=CAP_BPF --cap-add=CAP_PERFMON --cap-add=CAP_SYS_ADMIN ...

// Before starting the engine, verify BPF is usable:
// - running as root or with CAP_BPF/CAP_PERFMON (CAP_SYS_ADMIN on <5.8)
// - not blocked by seccomp/LSM (gVisor, hardened CI)
$ cat /proc/sys/kernel/unprivileged_bpf_disabled   # 0 or run privileged
$ docker run --privileged ...   # if inside a container

tracer, err := filetracer.New()
if err != nil {
  var perr *fmt.WrapError
  if strings.Contains(err.Error(), "setting target comm:") {
    slog.Warn("file tracer unavailable (BPF map update rejected); continuing without tracing", "err", err)
  } else {
    return err
  }
}

When it happens

Trigger: Calling filetracer.New when the loaded BPF maps are invalid or already closed, the kernel refuses the map update (BPF disabled, locked-down seccomp/LSM, missing CAP_BPF/CAP_SYS_ADMIN in restricted environments), or an fd/resource limit prevents map access.

Common situations: Running the engine inside a container without the required BPF capabilities or with /proc/sys/kernel/unprivileged_bpf_disabled and no privileges; kernel older than the map type requires; nested virtualization/CI runners that block bpf() syscalls; objs.Close() raced with Put after a prior init failure.

Related errors

• removing memlock limit: %w
• attaching sys_enter_mount tracepoint: %w
• attaching sys_exit_mount tracepoint: %w
• reading kallsyms: %w
• can't load fileops: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/aaf6118ba4ab1ee3. Report an issue: GitHub.