apache/flink · error · IOException

JAR file can't be read '{}'

Error message

JAR file can't be read '{}'

What it means

The third existence/readability check in JarUtils.checkJarFile: the file at the jar URL exists, but File.canRead() returns false, so the process cannot open it. This IOException reports the absolute path of the unreadable file.

Source

Thrown at flink-core/src/main/java/org/apache/flink/util/JarUtils.java:49

import java.util.jar.JarFile;
import java.util.stream.Collectors;

/** Utility functions for jar files. */
@Internal
public class JarUtils {

    public static void checkJarFile(URL jar) throws IOException {
        File jarFile;
        try {
            jarFile = new File(jar.toURI());
        } catch (URISyntaxException e) {
            throw new IOException("JAR file path is invalid '" + jar + '\'');
        }
        if (!jarFile.exists()) {
            throw new IOException("JAR file does not exist '" + jarFile.getAbsolutePath() + '\'');
        }
        if (!jarFile.canRead()) {
            throw new IOException("JAR file can't be read '" + jarFile.getAbsolutePath() + '\'');
        }

        try (JarFile ignored = new JarFile(jarFile)) {
            // verify that we can open the Jar file
        } catch (IOException e) {
            throw new IOException(
                    "Error while opening jar file '" + jarFile.getAbsolutePath() + '\'', e);
        }
    }

    public static List<URL> getJarFiles(final String[] jars) {
        if (jars == null) {
            return Collections.emptyList();
        }

        return Arrays.stream(jars)
                .map(
                        jarPath -> {

View on GitHub (pinned to 2f3c205e92)

Solutions

1. Fix permissions on the file: chmod a+r /path/to.jar (or chown it to the Flink service user).
2. Check parent directory traversal rights (execute bit on each directory component).
3. Confirm which OS user the JobManager/TaskManager runs as and grant that user read access.
4. Re-copy the jar with the service account instead of root to avoid ownership mismatch.

Example fix

# before
-rw------- 1 root root 64M /opt/jars/my-connector.jar   # flink user cannot read

# after
chmod a+r /opt/jars/my-connector.jar
# or: chown flink:flink /opt/jars/my-connector.jar

Path p = Paths.get(jarUrl.toURI());
if (!Files.isReadable(p)) {
    throw new AccessDeniedException("No read access to jar: " + p + " (run as owner or chmod a+r)");
}
JarUtils.checkJarFile(jarUrl);

When it happens

Trigger: Calling JarUtils.checkJarFile with a URL to an existing file whose POSIX permissions deny read access to the current user (no 'r' bit for the Flink process owner), or a file owned by root with restrictive mode while Flink runs as a non-root user.

Common situations: Jar placed by root with chmod 600 and Flink runs as user 'flink'; security-hardened cluster images stripping read bits from dependency jars; files on an NFS mount with root_squash changing effective permissions.

Related errors

• An I/O error occurred while creating temporary file to extra
• Failed to create parent(s) for given base dir: %s
• File {} does not exist or the user running Flink ('{}') has
• Directory {} does not exist or an I/O error occurred
• Mkdirs failed to create {}

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/ab3ad9abd67ccb8b. Report an issue: GitHub.