Docker "error mounting ... operation not permitted" - Fix Mount Failures in CI

runc tried to set up a mount for the container and the kernel denied it with "operation not permitted". Usually a bind mount the runtime cannot perform in a restricted or nested environment.

What this error means

A docker run or docker compose up fails at container creation with error mounting "..." to rootfs ... operation not permitted. The image is fine; the mount setup is what fails.

docker run output

OCI runtime create failed: ... error mounting "/proc/sys" to rootfs ...
operation not permitted: unknown

Common causes

Restricted/nested runtime forbids the mount

Inside Docker-in-Docker or a sandboxed runner, the runtime may lack the capabilities to perform certain mounts (procfs, sysfs, bind mounts onto special paths), so they are denied.

The bind-mount source does not exist or is denied

A bind mount whose host path is missing, or sits on a filesystem mounted with restrictive options, cannot be mounted into the container.

A read-only or constrained graph filesystem

When the container storage sits on a filesystem with restrictive mount options, runc cannot set up the overlay/bind it needs.

How to fix it

Give the runtime the privileges the mount needs

For nested Docker, run the daemon with enough privilege/capabilities for the mounts your containers use.
Avoid mounting special paths (procfs/sysfs subpaths) unless the environment allows it.
Use the host Docker daemon rather than deeply nested runtimes where possible.

Verify bind-mount sources exist on the runner

Confirm the host path is present before the run; relative bind mounts in CI often point nowhere.

Terminal

ls -ld ./data            # source must exist for a bind mount
# create it if a tool expects it to be present
mkdir -p ./data

How to prevent it

Ensure bind-mount source paths exist in the job before docker run.
Run nested Docker with the capabilities your mounts require.
Avoid mounting restricted special paths in constrained runners.