dagger/dagger · error

working dir %s points to invalid target: %w

Error message

working dir %s points to invalid target: %w

What it means

Before starting the process, the container's working directory (procInfo.Meta.Cwd) is resolved against the rootfs with fs.RootPath. If resolution fails - typically because the Cwd escapes the rootfs via '..' or is invalid - exec setup fails with 'working dir %s points to invalid target'.

Source

Thrown at engine/engineutil/executor_spec.go:1051

	//nolint:staticcheck
	state.spec.Hooks.Prestart = append(state.spec.Hooks.Prestart, specs.Hook{
		Args: []string{
			"nvidia-container-runtime-hook",
			"prestart",
		},
		Path: "/usr/bin/nvidia-container-runtime-hook",
	})
	state.spec.Process.Env = append(state.spec.Process.Env, fmt.Sprintf("NVIDIA_VISIBLE_DEVICES=%s",
		strings.Join(state.execMD.EnabledGPUs, ","),
	))

	return nil
}

func (c *Client) createCWD(_ context.Context, state *execState) error {
	newp, err := fs.RootPath(state.rootfsPath, state.procInfo.Meta.Cwd)
	if err != nil {
		return fmt.Errorf("working dir %s points to invalid target: %w", newp, err)
	}
	if _, err := os.Stat(newp); err != nil {
		if err := user.MkdirAllAndChown(newp, 0o755, int(state.uid), int(state.gid), user.WithOnlyNew); err != nil {
			return fmt.Errorf("failed to create working directory %s: %w", newp, err)
		}
	}

	return nil
}

func (c *Client) setupNestedClient(ctx context.Context, state *execState) (rerr error) {
	if state.nestedClientMetadata == nil || state.nestedClientMetadata.ClientID == "" {
		return nil
	}

	if state.nestedClientMetadata.ClientSecretToken == "" {
		state.nestedClientMetadata.ClientSecretToken = randid.NewID()
	}

View on GitHub (pinned to 82ba2681db)

Solutions

1. Fix the workdir passed to WithWorkdir so it is a clean absolute path inside the container (e.g. /src/app, not /src/../..)
2. Normalize the path before passing it (path.Clean / strip leading '..' segments)
3. Check upstream directory/GitRef sources for paths that include '..' segments
4. Pin/upgrade Dagger if a legitimate path is rejected - RootPath semantics changed historically

Example fix

// before
ctr.WithWorkdir("/src/../..")
// after
ctr.WithWorkdir("/src")

func validWorkdir(wd string) bool {
    if !filepath.IsAbs(wd) { return false }
    return !strings.Contains(filepath.Clean(wd), "..")
}
// call before WithWorkdir
if !validWorkdir(wd) { return fmt.Errorf("invalid workdir %q", wd) }

When it happens

Trigger: Container.WithWorkdir (or Workspace/dir defaults) set a Cwd that fs.RootPath(rootfsPath, cwd) rejects, e.g. '/..', a path climbing above '/', or a malformed path.

Common situations: Passing user-supplied or computed workdir strings containing '..'; building images whose default WORKDIR interacts badly with path normalization; typos like '///' with traversals in WithWorkdir.

Related errors

• workspace config directory: %w
• workspace lock directory: %w
• get workdir: %w
• get abs path: %w
• eval symlinks: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/fa1f6435b7b3f471. Report an issue: GitHub.