[Bug]: `container build` fails with buildkit permissions issue

[davidhewitt]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

The following minimal reproduction fails to build an extremely basic dockerfile:

$ mkdir -p /tmp/container-build-repro
cat > /tmp/container-build-repro/Dockerfile <<'EOF'
FROM debian:bookworm-slim
RUN echo hi
EOF
container build --no-cache -t container-build-repro-test /tmp/container-build-repro

[+] Building 0.1s (5/5) FINISHED
 => [resolver] fetching image...docker.io/library/debian:bookworm-sl  0.0s
 => [internal] load build definition from Dockerfile                  0.0s
 => => transferring dockerfile: 73B                                   0.0s
 => [internal] load .dockerignore                                     0.0s
 => => transferring context: 2B                                       0.0s
 => oci-layout://docker.io/library/debian:bookworm-slim@sha256:60eac  0.0s
 => => resolve docker.io/library/debian:bookworm-slim@sha256:60eac75  0.0s
 => => extracting sha256:74f1dcfcc9c80045f6f6394ffcfc261cb19d0c71b97  0.0s
 => ERROR [linux/arm64 1/2] RUN echo hi                               0.0s
------
 > [linux/arm64 1/2] RUN echo hi:
------
Error: unknown: "failed to solve: failed to compute cache key: failed to unmount /tmp/containerd-mount3485907331: operation not permitted: failed to mount /tmp/containerd-mount3485907331: mount source: "/var/lib/buildkit/runc-native/snapshots/snapshots/11", target: "/tmp/containerd-mount3485907331", fstype: bind, flags: 20480, data: "", err: operation not permitted"

Problem description

I think the error seems to be some kind of internal buildkit state being corrupted. I have tried to stop / start the container system and continue, no joy.

I don't think it ever has worked for me on this machine, so it could be a configuration issue. Happy to try and/or share whatever could aid in debugging & diagnosis.

Environment

- OS: macOS 26.5.1 25F80
- Xcode: (none, just command line tools)
- Container: 1.0.0

Code of Conduct

• I agree to follow this project's Code of Conduct

[lakshitsoni26]

Hi! I'd love to help look into this. Could you share the full error output from the bottom of your terminal? Also, does this happen if you run the build with sudo?

[lakshitsoni26]

Hey @davidhewitt I just tracked down the root cause of this and opened a fix in PR #1922.

The issue here is actually identical to a bug causing mktemp (/var/folders/) builds to fail. On macOS, /tmp is a symlink to /private/tmp. There was a bug in URL+Extensions.swift where the internal path resolution logic was instantly resolving symlinks and tracking them by their /private/... paths, which completely mismatched the /tmp/... context path passed to the CLI.

Because of the mismatch, the CLI was effectively sending an empty or corrupted file context to buildkit, which caused the failed to compute cache key and missing Dockerfile errors.

My PR fixes the path normalization to safely strip the /private/ prefixes without destroying the symlink paths, which gets this working perfectly again. Feel free to pull my branch and test it out!