hashicorp/nomad · error

Failed to mount task dir: %v

Error message

Failed to mount task dir: %v

What it means

TaskDir.Build (Unveil mode) calls mountDir(t.Dir, t.MountsTaskDir, ...) to bind-mount the task directory into the client mounts path. This error wraps mountDir's failure for the task dir. mountDir typically creates the mount point and performs a bind mount, so failures come from mount(2) or mount-point setup.

Source

Thrown at client/allocdir/task_dir.go:200

		}

		nobodyUID, nobodyGID, _, err := dynamic.LookupUser("nobody")
		if err != nil {
			return fmt.Errorf("Failed to lookup nobody user: %v", err)
		}

		// create the task unique directory under the client mounts path
		parent := filepath.Dir(t.MountsAllocDir)
		if err = os.MkdirAll(parent, fileMode710); err != nil {
			return fmt.Errorf("Failed to create task mount directory: %v", err)
		}
		if err = os.Chown(parent, uid, gid); err != nil {
			return fmt.Errorf("Failed to chown task mount directory: %v", err)
		}

		// create the taskdir mount point
		if err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {
			return fmt.Errorf("Failed to mount task dir: %v", err)
		}

		// create the allocdir mount point (owned by nobody)
		if err = mountDir(filepath.Join(t.AllocDir, "/alloc"), t.MountsAllocDir, nobodyUID, nobodyGID, fileMode777); err != nil {
			return fmt.Errorf("Failed to mount alloc dir: %v", err)
		}

		// create the secretsdir mount point
		if err = mountDir(t.SecretsDir, t.MountsSecretsDir, uid, gid, fileMode710); err != nil {
			return fmt.Errorf("Failed to mount secrets dir: %v", err)
		}
	}

	return nil
}

// buildChroot takes a mapping of absolute directory or file paths on the host
// to their intended, relative location within the task directory. This

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the wrapped error from mountDir: EPERM/EACCES → run client as root or grant CAP_SYS_ADMIN; EBUSY → unmount stale target (`umount <MountsTaskDir>`)
2. Verify the host allows bind mounts (no `--security-opt no-new-privileges`/seccomp denial when containerized)
3. Check `mount | grep <data_dir>` for leftover mounts from dead allocs and clean them
4. If bind mounts are unsupported on the platform, use a driver/fs-isolation mode without Unveil mounts

Example fix

# before
Failed to mount task dir: permission denied
# after (containerized client)
docker run --cap-add SYS_ADMIN ... # or run nomad directly on host as root
$ umount /var/nomad/client/mounts/<alloc>/task  # clear stale mount first

// preflight: can we bind-mount at all?
if err := syscall.Mount(src, dst, "", syscall.MS_BIND, ""); err != nil {
    log.Fatalf("bind mounts unavailable (run as root / add CAP_SYS_ADMIN): %v", err)
} else {
    syscall.Unmount(dst, 0)
}

if err := taskDir.Build(fsi, chroot, username); err != nil {
    if strings.Contains(err.Error(), "Failed to mount task dir") {
        // umount stale target, ensure root/CAP_SYS_ADMIN, retry build
        exec.Command("umount", mountsTaskDir).Run()
        return retryBuild()
    }
    return err
}

When it happens

Trigger: mountDir fails while building the task-dir mount point under fsisolation.Unveil: bind mounts disabled, mount point creation failed, or the source task dir vanished mid-build.

Common situations: Client running inside an unprivileged container without CAP_SYS_ADMIN (bind mount → EPERM); host with mount propagation restrictions; stale leftover mount at the target from a previous crashed alloc.

Related errors

• Failed to mount alloc dir: %v
• failed to remove alloc dir %q: %w
• Failed to make the alloc directory %v: %w
• Failed to mount shared directory for task: %w
• Failed to lookup nobody user: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6a335ec8bea54685. Report an issue: GitHub.