refusing unsafe change to bootstrap service '{}'; inspect `m

Error message

refusing unsafe change to bootstrap service '{}'; inspect `mise bootstrap plan`

What it means

mise refuses to compute an apply action for a `[bootstrap.services]` entry whose plan resolves to `ResourceAction::Unknown`. Unknown means the current systemd state could not be determined safely: the service was never inspected (systemctl missing), the unit file does not exist and no managed file provides it, or the unit cannot be enabled in its current unit-file state (e.g. `static`). mise deliberately fails instead of issuing blind systemctl commands against a service it cannot see.

Source

Thrown at src/system/services.rs:376

                state: self.state,
                enabled: self.enabled,
                masked: self.masked,
                on_change: self.on_change,
                dependency_changed,
                notified,
                active: self.is_active(),
            })),
            ResourceAction::Unknown if change.provides_unit && missing => Ok(Some(ServiceAction {
                unit: self.unit.clone(),
                state: self.state,
                enabled: self.enabled,
                masked: self.masked,
                on_change: self.on_change,
                dependency_changed,
                notified,
                active: false,
            })),
            ResourceAction::Unknown => bail!(
                "refusing unsafe change to bootstrap service '{}'; inspect `mise bootstrap plan`",
                self.name
            ),
            ResourceAction::Create | ResourceAction::Remove => {
                unreachable!("service lifecycle requests do not create or remove units")
            }
        }
    }

    fn from_action(action: &ServiceAction) -> Self {
        Self {
            name: action.unit.clone(),
            unit: action.unit.clone(),
            state: action.state,
            enabled: action.enabled,
            masked: action.masked,
            on_change: action.on_change,
            origin: None,

View on GitHub (pinned to 6f52dcdf99)

Solutions

Run `mise bootstrap plan` and read the `current` column for the failing service to see why inspection failed
Fix the service name typo or install the package that ships the unit
If the unit is managed by you, add it under `[[bootstrap.files]]` with `path = "/etc/systemd/system/<name>.service"` so the plan sees `provides_unit`
Ensure systemctl exists and systemd runs as PID 1 (bare containers/WSL without systemd hit this)
If the unit-file state is static, align the config (`enabled = false`) or use the supported enable mechanism for that unit

Example fix

# before
[bootstrap.services.myapp]
enabled = true
# unit /etc/systemd/system/myapp.service does not exist -> Unknown

# after
[[bootstrap.files]]
path = "/etc/systemd/system/myapp.service"
exec = "#!/bin/sh\nexec /usr/local/bin/myapp\n"

[bootstrap.services.myapp]
enabled = true

Defensive patterns

Strategy: validation

Validate before calling

mise bootstrap plan --json 2>/dev/null | jq -r '.services[] | select(.action == "unknown") | .id'
# any output = entries that will hit the refusal; fix them before apply

Prevention

Always run `mise bootstrap plan` before `apply` and treat any `unknown` action as a blocker
Declare every referenced unit under `[[bootstrap.files]]` so missing-unit cases become provide-and-update instead of unknown
Never assume systemctl exists: check `command -v systemctl` in container/CI images that will run bootstrap apply

When it happens

Trigger: Running `mise bootstrap apply` (directly or via the elevated helper) for a service where: systemctl is not on PATH (inspection Unavailable); the unit is Missing and `provides_unit` is false (no `[[bootstrap.files]]` entry supplies the unit file); or the plan set enabled=true but the existing unit-file state is not enableable (static/indirect/bad).

Common situations: Typo'd service name so the unit does not exist on the host; container or minimal VM without a running systemd/systemctl; referencing a unit shipped by a package that is not installed yet; vendored unit installed as `static` while config asks for enabled=true.

Related errors

AI-assisted analysis of jdx/mise@6f52dcdf99 (2026-08-22). Data as JSON: /api/errors/fdb60cab76ebb8d0. Report an issue: GitHub.