GitHub Actions cache "tar: Cannot mkdir: Permission denied"

By Kaveh Alemi·Latchkey

During restore, the cache action extracts a tar into the cached path. If that path is owned by root (often from a container step) while extraction runs as a different user, mkdir fails. Usually an ownership issue, occasionally a transient extraction blip.

What this error means

The cache restore or save step fails with tar reporting it cannot mkdir a subdirectory of the cached path because permission is denied.

/usr/bin/tar: ./.cache/build: Cannot mkdir: Permission denied
Warning: Failed to restore: tar exited with code 2

Common causes

Cached path owned by root

A prior container or sudo step created the path as root, and the non-root extraction cannot write into it.

Read-only or wrong-owner mount

The path is on a mount the extraction user cannot modify.

How to fix it

Fix ownership before caching

1. chown the cached path to the runner user before the cache step extracts into it.
2. Avoid creating the cached directory as root in an earlier step.
3. If a container step must own it, cache a path the host user controls.

- name: Fix cache dir ownership
  run: sudo chown -R "$(id -u):$(id -g)" ./.cache || true
- uses: actions/cache@v4
  with:
    path: ./.cache
    key: build-${{ hashFiles('**/lockfile') }}

How to prevent it

• Keep cached paths owned by the runner user, not root.
• On Latchkey managed runners, a transient extraction failure on restore is retried automatically; a genuine ownership mismatch still needs the chown fix.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions