google-gemini/gemini-cli · error · FatalSandboxError

Failed to mount workspace into LXC container '${containerNam

Error message

Failed to mount workspace into LXC container '${containerName}': ${err instanceof Error ? err.message : String(err)}

What it means

Thrown when `lxc config device add` fails while bind-mounting the host workspace directory into the LXC container as a disk device. The underlying lxc error message is embedded. This is a privileged filesystem operation that can fail for permissions, path, or LXD configuration reasons.

Source

Thrown at packages/cli/src/utils/sandbox.ts:1005

    )}`;
    devicesToRemove.push(workspaceDeviceName);

    try {
      await execFileAsync('lxc', [
        'config',
        'device',
        'add',
        containerName,
        workspaceDeviceName,
        'disk',
        `source=${workdir}`,
        `path=${workdir}`,
      ]);
      debugLogger.log(
        `mounted workspace '${workdir}' into container as device '${workspaceDeviceName}'`,
      );
    } catch (err) {
      throw new FatalSandboxError(
        `Failed to mount workspace into LXC container '${containerName}': ${err instanceof Error ? err.message : String(err)}`,
      );
    }

    // Add custom allowed paths from config
    if (config.allowedPaths) {
      for (const hostPath of config.allowedPaths) {
        if (hostPath && path.isAbsolute(hostPath) && fs.existsSync(hostPath)) {
          const allowedDeviceName = `gemini-allowed-${randomBytes(4).toString(
            'hex',
          )}`;
          devicesToRemove.push(allowedDeviceName);
          try {
            await execFileAsync('lxc', [
              'config',
              'device',
              'add',
              containerName,

View on GitHub (pinned to 5024443c72)

Solutions

1. Run the failing command manually to see the full lxc error: `lxc config device add <containerName> test disk source=<workdir> path=<workdir>`.
2. Fix idmap/UID mapping: ensure your user is in the lxd group and `lxc config set <containerName> raw.idmap ...` if needed.
3. Move the workspace to a filesystem LXD supports (ext4/btrfs/zfs), or use a Docker sandbox backend instead.
4. Free space on the LXD storage pool if the error indicates a space issue.

const { execFileSync } = require('child_process');
const path = require('path');
function dryRunMount(containerName, workdir) {
  // Probe the mount command before the sandbox uses it.
  execFileSync('lxc', ['config','device','add', containerName, 'probe', 'disk', `source=${workdir}`, `path=${workdir}`], {stdio:'pipe'});
  execFileSync('lxc', ['config','device','remove', containerName, 'probe'], {stdio:'pipe'});
}

try {
  await mountWorkspace(containerName, workdir);
} catch (e) {
  if (e instanceof FatalSandboxError && /Failed to mount workspace/.test(e.message)) {
    // inspect lxc error, fix idmap/permissions, then retry or fall back to docker backend
  } else throw e;
}

When it happens

Trigger: The spawnSync('lxc', ['config','device','add', containerName, workspaceDeviceName, 'disk', `source=${workdir}`, `path=${workdir}`]) call throws — caught by the surrounding try/catch and rethrown as FatalSandboxError.

Common situations: workdir is on a filesystem LXD cannot share (e.g. certain network/shiftfs setups). Permission mismatch between host UID and container UID (idmap issues). Container is read-only or restricted by LXD security policy. Path contains characters lxc rejects. LXD storage pool full.

Related errors

• Failed to query LXC container '${containerName}': ${err inst
• LXC container '${containerName}' not found. Create one with:
• LXC container '${containerName}' is not running (current sta
• Unable to create ${dirPath} directory. Do you have file perm
• Missing mount path '${from}' listed in SANDBOX_MOUNTS

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/d49a39866c5af3b5. Report an issue: GitHub.