{"record":{"id":"11cdf6d342220a24","repo":"hashicorp/nomad","slug":"failed-to-read-random-bytes-v","errorCode":null,"errorMessage":"failed to read random bytes: %v","messagePattern":"failed to read random bytes: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"helper/uuid/uuid.go","lineNumber":16,"sourceCode":"// Copyright IBM Corp. 2015, 2026\n// SPDX-License-Identifier: MPL-2.0\n\npackage uuid\n\nimport (\n\t\"fmt\"\n\n\t\"github.com/hashicorp/nomad/helper/crypto\"\n)\n\n// Generate is used to generate a random UUID.\nfunc Generate() string {\n\tbuf, err := crypto.Bytes(16)\n\tif err != nil {\n\t\tpanic(fmt.Errorf(\"failed to read random bytes: %v\", err))\n\t}\n\n\treturn fmt.Sprintf(\"%08x-%04x-%04x-%04x-%12x\",\n\t\tbuf[0:4],\n\t\tbuf[4:6],\n\t\tbuf[6:8],\n\t\tbuf[8:10],\n\t\tbuf[10:16])\n}\n\n// Short is used to generate the first 8 characters of a UUID.\nfunc Short() string {\n\treturn Generate()[0:8]\n}\n","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/uuid/uuid.go#L1-L31","documentation":"Generate creates a random 16-byte UUID using hc-install-style crypto.Bytes; if the cryptographic random source fails it panics with this error, since a UUID cannot be produced without entropy. Being a panic, callers cannot recover via a returned error.","triggerScenarios":"Calling uuid.Generate() when the OS entropy source is unavailable or fails (e.g. getrandom/read of /dev/urandom errors on a constrained host).","commonSituations":"Containers with restricted /dev or seccomp blocking getrandom; extremely degraded hosts where urandom returns errors; test environments with stubbed crypto sources.","solutions":["Fix the host entropy source (verify /dev/urandom is accessible and seccomp allows getrandom)","Restore /dev/urandom device node in the container image","Pre-validate crypto entropy availability at startup rather than catching the panic"],"exampleFix":"// before\nid := uuid.Generate() // panics if crypto.Bytes fails\n// after\nif _, err := crypto.Bytes(16); err != nil {\n\tlog.Fatalf(\"no entropy available: %v\", err)\n}\nid := uuid.Generate()","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"func safeGenerateUUID() (string, error) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tfmt.Fprintf(os.Stderr, \"uuid generate panicked: %v\\n\", r)\n\t\t}\n\t}()\n\t// Generate panics on entropy failure; wrap the call site\n\treturn uuid.Generate(), nil\n}\n// check entropy health periodically: open/read /dev/urandom once at startup","preventionTips":["Verify /dev/urandom is present and getrandom syscall is allowed by seccomp/container policy","Read a few random bytes at startup as an entropy smoke test","Avoid launching with fully scrubbed /dev in containers (create device nodes)","Note Generate panics — isolate it from request paths if entropy is unreliable"],"tags":["uuid","randomness","crypto","panic"],"backgroundTag":"entropy-source-unavailable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}