[BUG]: Access denied at the beginning of jobs with MDP Hosted Linux Agent

[MauriceChocoSwiss]

What happened?

On the beginning of the job with a fresh Ubuntu 24.04 agent from the Managed DevOps Pool, it crash because can't access /mnt/vss folder.

I've tried within custom VNet or in isolated VNet, with fresh agent every build or same for multiples builds, with Standard B or D or F VM tier, with Standard or Premium disk tier.

I'm the administrator of the DevOps organization and Azure account.
I've test with a very simple pipeline with only a batch echo "hello World" too but nothing change.

All pipelines works with Microsoft-Hosted agent, but as I use private endpoints for my services with disabled public access I need to use Managed DevOps Pool integrated to my VNet with endpoints.

Tried with Ubuntu 22, same error.

With Windows images version it doesn't start at all, no provisioning with CustomScriptError error.

Versions

Agent ??? can't see the agent version... Ubuntu 24.04, build 20251112.124.1

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Ubuntu 24.04

Version controll system

No response

Relevant log output

2025-11-30T22:13:22.0640470Z ##[section]Starting: Job
2025-11-30T22:13:22.0969742Z ##[error]Access to the path '/mnt/vss' is denied.
2025-11-30T22:13:22.0980224Z ##[debug]System.UnauthorizedAccessException: Access to the path '/mnt/vss' is denied.
 ---> System.IO.IOException: Permission denied
   --- End of inner exception stack trace ---
   at System.IO.FileSystem.CreateParentsAndDirectory(String fullPath, UnixFileMode unixCreateMode)
   at System.IO.FileSystem.CreateDirectory(String fullPath, UnixFileMode unixCreateMode)
   at System.IO.Directory.CreateDirectory(String path)
   at Microsoft.VisualStudio.Services.Agent.Worker.JobRunner.RunAsync(AgentJobRequestMessage message, CancellationToken jobRequestCancellationToken) in /mnt/vss/_work/1/s/src/Agent.Worker/JobRunner.cs:line 175
2025-11-30T22:13:22.1003874Z ##[section]Finishing: Job

[MantavyaDh]

Hi @MauriceChocoSwiss , needed few clarifications on the issue -

1. What user is the agent configured to run as in your MDP pool settings?
2. Are you using a custom VM image or the default MDP image?

[MauriceChocoSwiss]

Hello @MantavyaDh, here is missing informations

1. If I understand the question, the user was me as I can see in the security tab of the agent on DevOps
2. I use standard VM Ubuntu Azure VM Image from the default one proposed by Azure in MDP

[GlashelderWhatever]

We have exactly the same issue.

We're also using a standard Ubuntu 24.04 image sized as Standard D2ads v5. I changed that to Standard_B1ms this morning and we started having this issue. I must say I didn't do another deployment this morning, so I don't know if we would have had this problem regardless of the change in size. Changing it back doesn't work. I've also tried recreating the entire DevOps pool, but that also doesn't work.

##[error]Access to the path '/mnt/vss' is denied.
Pool: [pool]
Queued: Today at 09:12 manage parallel jobs
Agent: devpool-iac-iac-devcenter-devopspool 1
Started: Today at 09:16
Duration: <1s

The agent request is already running or has already completed.
Job preparation parameters
Parent pipeline used these runtime parameters
Job live console data:
Starting: Deploy tst

[MauriceChocoSwiss]

Little update. I don't know how or what make it work but... now my agent run... I've tried with Windows server just before and now it work. I've tried to set the AZP_AGENT_IGNORE_VSTSTASKLIB variable in the pipeline variable to true or 1 (don't work) like described here #5403

I don't know if it's this or the Windows test or another param because I've removed the variable and now it work anyway...

My first tries are on Standard_B1ls and actually I'm on Standard_B4ms. Maybe it have to do with this issue ?

I'll test that soon and make an update here