apache/flink · error · ProgramInvocationException

Cannot access jar file{t.getMessage() == null ? "." : ": " +

Error message

Cannot access jar file{t.getMessage() == null ? "." : ": " + t.getMessage()}

What it means

A catch-all (Throwable) thrown when JarUtils.checkJarFile throws something that is not an IOException — e.g., a SecurityException, RuntimeException, or Error. The message includes the throwable's message if non-null, or a period if null. This guards against unexpected failures during jar accessibility checks.

Source

Thrown at flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java:623

                                    && name.startsWith("lib/")
                                    && name.endsWith(".jar");
                        })
                .collect(Collectors.toList());
    }

    private static void deleteExtractedLibraries(List<File> tempLibraries) {
        for (File f : tempLibraries) {
            f.delete();
        }
    }

    private static void checkJarFile(URL jarfile) throws ProgramInvocationException {
        try {
            JarUtils.checkJarFile(jarfile);
        } catch (IOException e) {
            throw new ProgramInvocationException(e.getMessage(), e);
        } catch (Throwable t) {
            throw new ProgramInvocationException(
                    "Cannot access jar file"
                            + (t.getMessage() == null ? "." : ": " + t.getMessage()),
                    t);
        }
    }

    @Override
    public void close() {
        try {
            userCodeClassLoader.close();
        } catch (IOException e) {
            LOG.debug("Error while closing user-code classloader.", e);
        }
        try {
            deleteExtractedLibraries();
        } catch (Exception e) {
            LOG.debug("Error while deleting jars extracted from user-jar.", e);
        }

View on GitHub (pinned to 2f3c205e92)

Solutions

Read the chained Throwable to identify the non-IO failure type.
If SecurityException, grant FilePermission or relevant read permissions.
Check SELinux/AppArmor labels on the jar file.
Disable custom URL stream handler factories if in use.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    PackagedProgram.newBuilder().setJarFile(jarFile).build();
} catch (ProgramInvocationException e) {
    Throwable cause = e.getCause();
    if (cause instanceof SecurityException) {
        // grant FilePermission or check SELinux
    }
    throw e;
}

Prevention

Ensure the Flink process has read permissions on all jar files.
Check SELinux/AppArmor labels if running under Linux security modules.
Avoid running Flink with an overly restrictive security manager.

When it happens

Trigger: A security manager denies read access to the jar, a custom protocol handler for the URL throws a non-IO exception, or an internal assertion in JarUtils fails.

Common situations: Security manager or SELinux blocking file reads, custom URL stream handlers behaving incorrectly, or classpath/resource access restrictions in a sandboxed environment.

Related errors

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/6ad0b32218cc1c4e. Report an issue: GitHub.