hashicorp/nomad · error

mount --rbind %s %s failed: %q

Error message

mount --rbind %s %s failed: %q

What it means

When the initial shared remount of /var/run/netns returns EINVAL, the directory is not yet a mountpoint, so NewNS recursively bind-mounts /var/run/netns onto itself to 'upgrade' it. If that bind-mount fails, this error is returned. It means the kernel refused the recursive bind mount of the netns directory onto itself.

Source

Thrown at client/lib/nsutil/netns_linux.go:60

	err := os.MkdirAll(NetNSRunDir, 0755)
	if err != nil {
		return nil, err
	}

	// Remount the namespace directory shared. This will fail if it is not
	// already a mountpoint, so bind-mount it on to itself to "upgrade" it
	// to a mountpoint.
	err = unix.Mount("", NetNSRunDir, "none", unix.MS_SHARED|unix.MS_REC, "")
	if err != nil {
		if err != unix.EINVAL {
			return nil, fmt.Errorf("mount --make-rshared %s failed: %q", NetNSRunDir, err)
		}

		// Recursively remount /var/run/netns on itself. The recursive flag is
		// so that any existing netns bindmounts are carried over.
		err = unix.Mount(NetNSRunDir, NetNSRunDir, "none", unix.MS_BIND|unix.MS_REC, "")
		if err != nil {
			return nil, fmt.Errorf("mount --rbind %s %s failed: %q", NetNSRunDir, NetNSRunDir, err)
		}

		// Now we can make it shared
		err = unix.Mount("", NetNSRunDir, "none", unix.MS_SHARED|unix.MS_REC, "")
		if err != nil {
			return nil, fmt.Errorf("mount --make-rshared %s failed: %q", NetNSRunDir, err)
		}

	}

	// create an empty file at the mount point
	nsPath := path.Join(NetNSRunDir, nsName)
	mountPointFd, err := os.Create(nsPath)
	if err != nil {
		return nil, err
	}
	mountPointFd.Close()

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Run with CAP_SYS_ADMIN / privileged mode so bind mounts are permitted
2. Pre-create and pre-mount the directory on the host: mkdir -p /run/netns && mount --bind /run/netns /run/netns
3. Check the filesystem is writable (not mounted read-only)
4. On predefined shared volumes, mount /run/netns as shared into the container

Example fix

// before: read-only /run causes failure
// after (host setup before starting the container):
// mkdir -p /run/netns && mount --bind /run/netns /run/netns && mount --make-shared /run/netns
ns, err := nsutil.NewNS()

if err := unix.Mount("/run/netns", "/run/netns", "", unix.MS_BIND|unix.MS_REC, ""); err != nil {
    return fmt.Errorf("/run/netns cannot be bind-mounted (need CAP_SYS_ADMIN): %v", err)
}

ns, err := nsutil.NewNS()
if err != nil && strings.Contains(err.Error(), "--rbind") {
    return fmt.Errorf("cannot upgrade /run/netns to a mountpoint; pre-mount it on the host: %w", err)
}

When it happens

Trigger: unix.Mount(NetNSRunDir, NetNSRunDir, "none", MS_BIND|MS_REC) returns an error during NewNS (via CreateNetwork), i.e. /var/run/netns is not a mountpoint AND the self bind-mount is denied (EPERM, ENOENT, etc.).

Common situations: Unprivileged container runtimes denying mounts; /var/run/netns deleted between the first Mount and the bind-mount; read-only /run filesystem (EROFS) in locked-down containers.

Related errors

• failed to bind mount ns at %s: %v
• mount --make-rshared %s failed: %q
• Failed to unmount proc %q: %w
• failed to get the current netns: %v
• error from unshare: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1bdfa3598f08b228. Report an issue: GitHub.