failed to create alloc/logs/envoy_bootstrap.stderr.0 for env

Error message

failed to create alloc/logs/envoy_bootstrap.stderr.0 for envoy: %w

What it means

Same retry closure as the bootstrap stdout file: the hook opens alloc/logs/envoy_bootstrap.stderr.N with os.OpenFile to capture the consul command's stderr. This error wraps a failure to open/create that stderr debug file, so the bootstrap command is not run and Prestart fails.

Source

Thrown at client/allocrunner/taskrunner/envoy_bootstrap_hook.go:382

		default:
		}

		// Prepare bootstrap command to run.
		cmd := exec.CommandContext(ctx, "consul", bootstrapArgs...)
		cmd.Env = bootstrapEnv

		// Redirect stdout to secrets/envoy_bootstrap.json.
		stdout, fileErr := os.Create(bootstrapFilePath)
		if fileErr != nil {
			return false, fmt.Errorf("failed to create secrets/envoy_bootstrap.json for envoy: %w", fileErr)
		}
		defer stdout.Close()
		cmd.Stdout = stdout

		// Redirect stderr into another file for later debugging.
		stderr, fileErr := os.OpenFile(bootstrapStderrPath, os.O_RDWR|os.O_CREATE, 0644)
		if fileErr != nil {
			return false, fmt.Errorf("failed to create alloc/logs/envoy_bootstrap.stderr.0 for envoy: %w", fileErr)
		}
		defer stderr.Close()
		cmd.Stderr = stderr

		// Generate bootstrap
		cmdErr = cmd.Run()

		// Command succeeded, exit.
		if cmdErr == nil {
			// Bootstrap written. Move on without marking as Done as Prestart needs
			// to rerun after node reboots.
			return false, nil
		}

		// Command failed, prepare for retry
		//
		// Cleanup the bootstrap file. An errors here is not
		// important as (a) we test to ensure the deletion

View on GitHub (pinned to 482b49bf1a)

Solutions

Ensure the alloc dir's logs/ directory exists and is writable by the Nomad client user.
Check disk space and filesystem health on the alloc-dir volume.
Review SELinux/AppArmor or container sandbox denials.
Restart the allocation so the task runner recreates the directory layout.

Defensive patterns

Strategy: validation

Validate before calling

// ensure the logs directory exists and is writable before Prestart
if err := os.MkdirAll(filepath.Join(allocDir, "logs"), 0o750); err != nil { return err }
if fi, err := os.Stat(filepath.Join(allocDir, "logs")); err != nil || !fi.IsDir() {
    return fmt.Errorf("alloc logs dir unavailable")
}

Prevention

Preserve the alloc/logs directory lifecycle managed by the task runner.
Monitor filesystem health (I/O errors, quotas) on the alloc-dir volume.
Avoid external log collectors mutating ownership of alloc/logs.
Run Nomad with a client user permitted to create files under the alloc dir.

When it happens

Trigger: os.OpenFile(bootstrapStderrPath, os.O_RDWR|os.O_CREATE, 0644) fails — the logs directory is missing, unwritable, or the filesystem errors.

Common situations: alloc/logs directory deleted or never provisioned; permission/ownership issues on the alloc dir; read-only or full disk; sandbox policies blocking file creation.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1a66f4d70a22f84f. Report an issue: GitHub.