{"record":{"id":"01041797c5f78825","repo":"windmill-labs/windmill","slug":"inventory-path-a-k-a-name-is-invalid","errorCode":null,"errorMessage":"Inventory path (a.k.a. `name`) is invalid: {}","messagePattern":"Inventory path \\(a\\.k\\.a\\. `name`\\) is invalid: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-worker/src/ansible_executor.rs","lineNumber":2282,"sourceCode":"            }\n        }\n\n        let validated_path = write_file_at_user_defined_location(\n            job_dir,\n            &inventory.name,\n            content\n                .get(\"content\")\n                .and_then(|v| v.as_str())\n                .ok_or(anyhow!(\n                    \"Invalid inventory resource, `content` field absent or invalid\"\n                ))?,\n            None,\n        )\n        .map_err(|e| anyhow!(\"Couldn't write inventory: {}\", e))?;\n\n        nsjail_mounts.push(\n            define_nsjail_mount(job_dir, &validated_path)\n                .map_err(|e| anyhow!(\"Inventory path (a.k.a. `name`) is invalid: {}\", e))?,\n        );\n\n        logs.push_str(&format!(\"\\nCreated inventory `{}`\", inventory.name));\n    }\n\n    for file_res in &r.file_resources {\n        let r =\n            get_resource_or_variable_content(client, &file_res.resource_path, job_id.to_string())\n                .await?;\n        let path = file_res.target_path.clone();\n        let validated_path =\n            write_file_at_user_defined_location(job_dir, path.as_str(), &r, file_res.mode)\n                .map_err(|e| anyhow!(\"Couldn't write text file at {}: {}\", path, e))?;\n\n        nsjail_mounts.push(\n            define_nsjail_mount(job_dir, &validated_path)\n                .map_err(|e| anyhow!(\"File resource path is invalid: {}\", e))?,\n        );","sourceCodeStart":2264,"sourceCodeEnd":2300,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-worker/src/ansible_executor.rs#L2264-L2300","documentation":"After writing the inventory file, define_nsjail_mount is called to mount it inside the nsjail sandbox; any failure (including the 'Invalid path.' error 1023) is re-wrapped with this message pointing at the inventory's `name`. It means the inventory's name cannot be turned into a valid sandbox mount path.","triggerScenarios":"create_file_resources → define_nsjail_mount(job_dir, &validated_path) errors because the path derived from inventory.name escapes job_dir or is not representable (traversal segments, illegal path), then handle_ansible_job wraps it with 'Inventory path (a.k.a. `name`) is invalid: {}'.","commonSituations":"Inventory name containing `..`, absolute-path prefixes, or nested directory segments the nsjail mount config rejects; a name that strips to an empty relative path.","solutions":["Set inventory `name` to a plain flat filename with no `/`, `..`, or leading path separators.","Re-run after renaming; the wrapped inner error tells whether it was path escape or mount config.","If the name is already simple, treat it as a worker bug in define_nsjail_mount and check job_dir/validated_path computation.","Keep names consistent between the yaml and any callers passing the argument."],"exampleFix":"// before\ninventory: { name: \"../inventories/prod\" }\n// after\ninventory: { name: \"prod\" }","handlingStrategy":"validation","validationCode":"if (inventoryName.includes('/') || inventoryName.includes('..') || inventoryName === '') {\n  throw new Error('inventory name must be a single relative filename for nsjail mounting');\n}","typeGuard":"function isNsjailMountableName(s) {\n  return typeof s === 'string' && s.length > 0 && !s.includes('/') && !s.includes('..') && s !== '.';\n}","tryCatchPattern":null,"preventionTips":["Keep inventory `name` a single flat filename — no directories, no `..`.","Never use absolute paths as inventory names.","Smoke-test ansible scripts with file resources after worker/nsjail config changes.","Treat occurrences with already-simple names as worker bugs and inspect define_nsjail_mount."],"tags":["ansible","nsjail","path","sandbox"],"backgroundTag":"path-traversal","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}