Diagnostic code

ZBX-E0425

overlayfs can't be mounted for this container

Kind

error

Blame

environment

Exit code

2 (125 in zbx run)

What it means

A container started from a tree digest runs on an overlayfs mount: the tree is the read-only lower layer and the container's own writes go to an upper layer under the state directory. The kernel refused to mount it in the container's user and mount namespaces.

Unprivileged overlayfs needs Linux 5.11 or newer with the overlay module, and an upper layer on a file system that keeps user.* extended attributes. A security policy can also deny the mount. "zbx doctor" runs the same mount in a scratch directory and says which of these it is. A path that contains a comma, a colon or a backslash can not be given to the mount and is refused with this code too.

A container can still run on a plain directory: "zbx run --rootfs".

Offline

The same text, without a network:

zbx explain E0425