{"record":{"id":"338e1487a7356b88","repo":"ory/hydra","slug":"jsonnetsecure-eval","errorCode":null,"errorMessage":"jsonnetsecure: eval","messagePattern":"jsonnetsecure: eval","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/jsonnet_pool.go","lineNumber":274,"sourceCode":"\tparams.Snippet = snippet\n\tpp, err := json.Marshal(params)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: marshal\")\n\t}\n\n\tctx = context.WithValue(ctx, contextValuePath, vm.path)\n\tctx = context.WithValue(ctx, contextValueArgs, vm.args)\n\tworker, err := vm.pool.puddle.Acquire(ctx)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: acquire\")\n\t}\n\n\tctx, cancel := context.WithTimeoutCause(ctx, 1*time.Second, errors.Errorf(\"failed to run jsonnet within 1s: filename=%s\", filename))\n\tdefer cancel()\n\tresult, err := worker.Value().eval(ctx, pp)\n\tif err != nil {\n\t\tworker.Destroy()\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: eval\")\n\t} else {\n\t\tworker.Release()\n\t}\n\n\tif strings.HasPrefix(result, \"ERROR: \") {\n\t\treturn \"\", errors.New(\"jsonnetsecure: \" + result)\n\t}\n\n\treturn result, nil\n}\n\nfunc NewProcessPoolVM(opts *vmOptions) VM {\n\tctx := opts.ctx\n\tif ctx == nil {\n\t\tctx = context.Background()\n\t}\n\treturn &processPoolVM{\n\t\tpath: opts.jsonnetBinaryPath,","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/jsonnet_pool.go#L256-L292","documentation":"This is the errors.Wrap wrapper ('jsonnetsecure: eval') around any error returned by worker.Value().eval(ctx, pp) in EvaluateAnonymousSnippet. It can wrap the 1s deadline cause (error 180), a worker process crash/kill, or an eval transport failure. On this path the worker is destroyed (not returned to the pool) because it is presumed unhealthy.","triggerScenarios":"Any failure from worker.Value().eval during EvaluateAnonymousSnippet (oryx/jsonnetsecure/jsonnet_pool.go:274): context deadline exceeded (1s timeout), worker process died mid-eval, or the eval round-trip failed.","commonSituations":"Same as the timeout error: heavy snippets, worker process OOM-killed by the OS, or pool contention. The wrap message alone indicates the underlying cause is in the wrapped error chain.","solutions":["Unwrap the error (errors.Unwrap / %v of cause) to find the root cause — most often the 1s deadline.","Optimize the jsonnet snippet (less recursion, smaller data) so eval completes quickly.","Ensure jsonnet worker processes are not being killed (check memory limits, OOM killer logs).","Retry with backoff only if the cause is transient (e.g., busy pool), not for deterministic snippet errors."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil {\n    var cause error\n    for e := err; e != nil; e = errors.Unwrap(e) {\n        cause = e\n    }\n    log.Printf(\"jsonnet eval failed, root cause: %v\", cause)\n    return err\n}","preventionTips":["Always unwrap the error chain to distinguish timeout from worker crash.","Monitor worker process health (OOM kills) in production.","Do not retry deterministically failing snippets."],"tags":["jsonnet","worker-process","wrapped-error"],"backgroundTag":"worker-process-eval-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}