{"record":{"id":"16cf43eec1b87301","repo":"BerriAI/litellm","slug":"failed-to-read-private-key-file-file-path-e","errorCode":null,"errorMessage":"Failed to read private key file '{file_path}': {e}","messagePattern":"Failed to read private key file '(.+?)': (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"critical","filePath":"litellm/llms/oci/common_utils.py","lineNumber":135,"sourceCode":"    _require_cryptography()\n    key: Final = serialization.load_pem_private_key(\n        key_str.encode(\"utf-8\"),\n        password=None,\n    )\n    if not isinstance(key, rsa.RSAPrivateKey):\n        raise TypeError(\"The provided private key is not an RSA key, which is required for OCI signing.\")\n    return key\n\n\ndef load_private_key_from_file(file_path: str) -> Any:\n    \"\"\"Loads a private key from a file path.\"\"\"\n    try:\n        with open(file_path, \"r\", encoding=\"utf-8\") as f:\n            key_str: Final = f.read().strip()\n    except FileNotFoundError:\n        raise FileNotFoundError(f\"Private key file not found: {file_path}\")\n    except OSError as e:\n        raise OSError(f\"Failed to read private key file '{file_path}': {e}\") from e\n\n    if not key_str:\n        raise ValueError(f\"Private key file is empty: {file_path}\")\n\n    return load_private_key_from_str(key_str)\n\n\n# ---------------------------------------------------------------------------\n# Env-var credential resolution\n# ---------------------------------------------------------------------------\n\n_OCI_REGION_ENV: Final = \"OCI_REGION\"\n_OCI_USER_ENV: Final = \"OCI_USER\"\n_OCI_FINGERPRINT_ENV: Final = \"OCI_FINGERPRINT\"\n_OCI_TENANCY_ENV: Final = \"OCI_TENANCY\"\n_OCI_KEY_FILE_ENV: Final = \"OCI_KEY_FILE\"\n_OCI_KEY_ENV: Final = \"OCI_KEY\"\n_OCI_COMPARTMENT_ID_ENV: Final = \"OCI_COMPARTMENT_ID\"","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/oci/common_utils.py#L117-L153","documentation":"load_private_key_from_file catches OSError (permission denied, directory-level I/O errors, SELinux denials) while opening the key file and re-raises it with context about which file failed. It signals the file exists but the process cannot read it.","triggerScenarios":"Key file owned by root while the app runs as a non-root user (mode 600, uid mismatch); read-only or corrupted mount; path points at a directory component with no execute permission; SELinux/AppArmor blocking reads on the secret mount.","commonSituations":"Docker containers running as app user with a secret mounted as root-owned; Kubernetes secret mounted read-only with restrictive fsGroup settings; files copied with sudo leaving 600 root:root; SELinux-enabled hosts (RHEL/CoreOS) denying container access.","solutions":["Fix ownership/permissions: chown <appuser> key.pem; chmod 400 key.pem.","In Kubernetes, set securityContext.fsGroup to the group that owns the mounted secret.","For SELinux hosts, label the volume correctly (z/Z mount option in Docker: -v ...:/secrets:ro,z).","Verify as the app user: sudo -u appuser cat <keyfile>."],"exampleFix":"# before — root-owned key, app cannot read\n# docker: COPY --chown=root oci_key.pem /secrets/  → OSError\n\n# after\n# Dockerfile: COPY --chown=1000:1000 oci_key.pem /secrets/\n# or run: chmod 400 + chown appuser","handlingStrategy":"validation","validationCode":"import os\np = os.path.expanduser(os.environ[\"OCI_KEY_FILE\"])\nassert os.path.isfile(p) and os.access(p, os.R_OK), f\"cannot read key file: {p} (perms/owner?)\"","typeGuard":null,"tryCatchPattern":"try:\n    litellm.completion(model=\"oci/...\", messages=m)\nexcept OSError as e:\n    if \"Failed to read private key file\" in str(e):\n        fix_ownership_or_die()  # chown/chmod, fsGroup, SELinux label\n    raise","preventionTips":["Set fsGroup in Kubernetes securityContext for secret mounts.","chmod 400 and chown to the runtime user in Docker images.","Use the -v :ro,z mount option on SELinux hosts."],"tags":["oci","authentication","permissions","deployment"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}