MongoDB WiredTiger Fails on Docker VMM with Bind-Mounted Volume but Works with WSL2 and Docker Managed Volumes

Start by reproducing the failure with MongoDB 7.0, Docker VMM, and the bind-mounted ./data/mongo:/data/db configuration, then compare it with WSL2 and a Docker-managed volume. Use the WiredTiger "Operation not permitted" startup error and the provided diagnostics ID to investigate; done means the bind-mounted database starts successfully under Docker VMM or the incompatibility is documented with a confirmed workaround.

Bug report

Bug description

MongoDB fails to start when using Docker Desktop's Docker VMM backend with a bind-mounted host directory for /data/db.

The same MongoDB container, image, compose configuration, and data work correctly when:

1. Switching Docker Desktop back to WSL2.
2. Replacing the bind mount with a Docker-managed volume while remaining on Docker VMM.

This appears to be a filesystem compatibility issue between Docker VMM bind mounts and MongoDB WiredTiger.

Reproduction steps

Environment

• Docker Desktop for Windows
• Docker VMM enabled
• MongoDB 7.0.40 (mongo:7.0)
• Docker Compose
• Bind-mounted host directory

Reproduction Steps

Failing Configuration

services:
  mongo:
    image: mongo:7.0
    volumes:
      - ./data/mongo:/data/db

Steps

1. Configure Docker Desktop to use Docker VMM.
2. Start the MongoDB container using the above bind mount.
3. Observe container startup failure.

Actual Behavior

MongoDB terminates during WiredTiger startup with:

Storage engine to use detected by data files
Opening WiredTiger

__posix_open_file:815:/data/db/WiredTiger.wt: handle-open: open
error_str":"Operation not permitted"

Failed to start up WiredTiger under any compatibility version.
Terminating.
reason":"1: Operation not permitted"

Expected Behavior

MongoDB should start successfully using a bind-mounted host directory when running under Docker VMM.

Validation Tests

Test 1: Switch to WSL2

No changes made to:

• Container image
• Compose file
• Bind mount
• Database files

Only changed Docker Desktop from Docker VMM to WSL2.

Result: MongoDB starts successfully.

Test 2: Use Docker Managed Volumes

Changed compose file to:

services:
  mongo:
    image: mongo:7.0
    volumes:
      - mongo-data:/data/db

volumes:
  mongo-data:

Docker VMM remained enabled.

Result: MongoDB starts successfully.

Results Matrix

Conclusion

The issue appears specific to the combination of:

• Docker VMM
• Bind-mounted host filesystem
• MongoDB WiredTiger

The same data, image, and configuration work correctly when either:

1. Using WSL2 with the bind mount, or
2. Using Docker-managed volumes with Docker VMM.

This suggests a filesystem compatibility issue in Docker VMM's bind mount implementation that affects MongoDB WiredTiger.

Platform

Windows

Version information

Client:
 Version:           29.7.2
 API version:       1.55
 Go version:        go1.26.5
 Git commit:        a7dcaa6
 Built:             Wed Aug  5 18:31:33 2026
 OS/Arch:           windows/amd64
 Context:           desktop-linux

Server: Docker Desktop 4.88.1 (237512)
 Engine:
  Version:          29.7.2
  API version:      1.55 (minimum version 1.40)
  Go version:       go1.26.5
  Git commit:       6a43e3d
  Built:            Wed Aug  5 18:28:36 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.3.3
  GitCommit:        aad11006b869517fcd3009450b6f82da282e1a9b
 runc:
  Version:          1.4.3
  GitCommit:        v1.4.3-0-gbb14dabe
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
Client:
 Version:    29.7.2
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  agent: Docker AI Agent Runner (Docker Inc.)
    Version:  v1.124.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-agent.exe
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.30.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-ai.exe
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.36.1-desktop.1
    Path:     C:\Program Files\Docker\cli-plugins\docker-buildx.exe
  compose: Docker Compose (Docker Inc.)
    Version:  v5.4.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-compose.exe
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.47
    Path:     C:\Program Files\Docker\cli-plugins\docker-debug.exe
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  v0.4.3
    Path:     C:\Program Files\Docker\cli-plugins\docker-desktop.exe
  dhi: CLI for managing Docker Hardened Images (Docker Inc.)
    Version:  v0.0.7
    Path:     C:\Program Files\Docker\cli-plugins\docker-dhi.exe
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.31
    Path:     C:\Program Files\Docker\cli-plugins\docker-extension.exe
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-init.exe
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.43.3
    Path:     C:\Program Files\Docker\cli-plugins\docker-mcp.exe
  model: Docker Model Runner (Docker Inc.)
    Version:  v1.2.6
    Path:     C:\Program Files\Docker\cli-plugins\docker-model.exe
  offload: Docker Offload (Docker Inc.)
    Version:  v0.6.13
    Path:     C:\Program Files\Docker\cli-plugins\docker-offload.exe
  pass: Docker Pass Secrets Manager Plugin (beta) (Docker Inc.)
    Version:  v0.2.1
    Path:     C:\Program Files\Docker\cli-plugins\docker-pass.exe
  sandbox: "docker sandbox" is deprecated, use Docker Sandboxes instead (Docker Inc.)
    Version:  v0.13.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-sandbox.exe
  scout: Docker Scout (Docker Inc.)
    Version:  v1.24.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-scout.exe

Server:
 Containers: 5
  Running: 0
  Paused: 0
  Stopped: 5
 Images: 5
 Server Version: 29.7.2
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: aad11006b869517fcd3009450b6f82da282e1a9b
 runc version: v1.4.3-0-gbb14dabe
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 7.0.12-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 16
 Total Memory: 3.879GiB
 Name: docker-desktop
 ID: 111c8ce9-8b8a-4972-a55e-0bb839c94658
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=npipe://\\.\pipe\docker_cli
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables

Diagnostics ID

89646907-0FB3-40EE-9AB0-90E99CCD4B14/20260902212017