GoogleContainerTools/skaffold · error

unable to open provided file %s

Error message

unable to open provided file %s

What it means

In `skaffold apply` (cmd/skaffold/app/cmd/apply.go:75), validateManifests tries to open each provided manifest file; if os.Open fails with any error other than os.ErrNotExist (permission denied, path is a directory, I/O error), this error is returned.

Source

Thrown at cmd/skaffold/app/cmd/apply.go:75

func doApply(ctx context.Context, out io.Writer, args []string) error {
	// force set apply boolean to select default options in runner creation
	opts.Apply = true
	opts.HydratedManifests = args
	if err := validateManifests(args); err != nil {
		return err
	}
	return withRunner(ctx, out, func(r runner.Runner, configs []util.VersionedConfig) error {
		return r.Apply(ctx, out)
	})
}

func validateManifests(manifests []string) error {
	for _, m := range manifests {
		if _, err := os.Open(m); err != nil {
			if errors.Is(err, os.ErrNotExist) {
				return fmt.Errorf("cannot find provided file %s", m)
			}
			return fmt.Errorf("unable to open provided file %s", m)
		}

		if _, err := kubernetes.ParseKubernetesObjects(m); err != nil {
			return errors.Wrap(err, fmt.Sprintf("%s is not a valid Kubernetes manifest", m))
		}
	}
	return nil
}

View on GitHub (pinned to a1189de023)

Solutions

1. Fix file permissions (chmod/chown) so the user running skaffold can read the manifest
2. Verify the path is a regular file, not a directory (`file <path>`)
3. Run the command as a user with access to the file, or copy it to an accessible location
4. Check OS-level access controls (SELinux denials, container mount options) if permissions look correct

Example fix

// before: unreadable manifest
// -rw------- root root manifests/deployment.yaml
// after
// chmod 644 manifests/deployment.yaml  # then rerun skaffold apply

// Before apply, ensure manifests are readable regular files
info, err := os.Stat(m)
if err != nil || info.IsDir() {
    return fmt.Errorf("not a readable file: %s", m)
}
if f, err := os.Open(m); err != nil {
    return fmt.Errorf("no read permission: %s (%v)", m, err)
} else {
    f.Close()
}

if err := sh.Run("skaffold", "apply", "--filepath", m); err != nil {
    if strings.Contains(err.Error(), "unable to open provided file") {
        log.Fatalf("cannot open %s: check permissions and that it is a file", m)
    }
    return err
}

When it happens

Trigger: Running `skaffold apply` with a manifest path that exists but cannot be opened: read permission denied for the current user, the path is a directory, or a device/IO error occurs during open.

Common situations: Manifest owned by root with 0600 permissions while running as a non-root CI user; passing a directory instead of a file; an unreadable mounted volume in a containerized CI runner; SELinux/AppArmor blocking access.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• cannot find provided file %s
• loading post-renderer result: %w
• loading manifests: %w
• `apply` requires at least one manifest argument
• `exec` requires exactly one action to execute

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/bddc4da53cb936c5. Report an issue: GitHub.