{"record":{"id":"3db8d4a8db943349","repo":"ory/hydra","slug":"jsonnetsecure-result","errorCode":null,"errorMessage":"jsonnetsecure: \" + result","messagePattern":"jsonnetsecure: \" \\+ result","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/jsonnet_pool.go","lineNumber":280,"sourceCode":"\tctx = context.WithValue(ctx, contextValuePath, vm.path)\n\tctx = context.WithValue(ctx, contextValueArgs, vm.args)\n\tworker, err := vm.pool.puddle.Acquire(ctx)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: acquire\")\n\t}\n\n\tctx, cancel := context.WithTimeoutCause(ctx, 1*time.Second, errors.Errorf(\"failed to run jsonnet within 1s: filename=%s\", filename))\n\tdefer cancel()\n\tresult, err := worker.Value().eval(ctx, pp)\n\tif err != nil {\n\t\tworker.Destroy()\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: eval\")\n\t} else {\n\t\tworker.Release()\n\t}\n\n\tif strings.HasPrefix(result, \"ERROR: \") {\n\t\treturn \"\", errors.New(\"jsonnetsecure: \" + result)\n\t}\n\n\treturn result, nil\n}\n\nfunc NewProcessPoolVM(opts *vmOptions) VM {\n\tctx := opts.ctx\n\tif ctx == nil {\n\t\tctx = context.Background()\n\t}\n\treturn &processPoolVM{\n\t\tpath: opts.jsonnetBinaryPath,\n\t\targs: opts.args,\n\t\tctx:  ctx,\n\t\tpool: opts.pool,\n\t}\n}\n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/jsonnet_pool.go#L262-L298","documentation":"EvaluateAnonymousSnippet evaluates a jsonnet snippet inside a sandboxed worker process. If the worker completes but its stdout result begins with \"ERROR: \", the pool treats it as a failed evaluation and returns the payload verbatim as a Go error prefixed with \"jsonnetsecure: \". The text after the prefix is the raw jsonnet error emitted by the worker (usually a jsonnet compile/runtime error with file/line context).","triggerScenarios":"Calling EvaluateAnonymousSnippet (or NewProcessPoolVM-based eval) with a snippet that fails to parse, references undefined variables/functions, imports unavailable files, or triggers a jsonnet runtime error (e.g. assertion failure, division by zero).","commonSituations":"Malformed or hand-written jsonnet config files, typos in field names, missing imports since the sandbox cannot read arbitrary paths, using jsonnet stdlib features unsupported by the pinned jsonnet version.","solutions":["Read the text after the 'jsonnetsecure: ERROR: ' prefix — it contains the jsonnet file:line and message; fix the snippet accordingly.","Run the snippet through a local `jsonnet` CLI (same version) to reproduce and iterate on the error quickly.","If it's an import error, ensure the importer/security config of the pool VM permits the path or inline the data instead.","Validate the snippet is passed as anonymous snippet (not cached/found differently) and check for accidental wrapping or escaping issues in the caller."],"exampleFix":"// before\nout, err := vm.EvaluateAnonymousSnippet(\"config.jsonnet\", `std.extVar('missing')`)\n// after\nout, err := vm.EvaluateAnonymousSnippet(\"config.jsonnet\", `{ greeting: \"hello\" }`) // no undefined extVars/imports","handlingStrategy":"try-catch","validationCode":"snippet := `std.extVar(\"missing\")`\nif strings.Contains(snippet, \"std.extVar\") && !extVarsProvided {\n\treturn fmt.Errorf(\"snippet uses std.extVar but no extVars were supplied\")\n}","typeGuard":null,"tryCatchPattern":"result, err := vm.EvaluateAnonymousSnippet(\"snippet.jsonnet\", snippet)\nif err != nil {\n\tif strings.Contains(err.Error(), \"ERROR: \") {\n\t\t// jsonnet-level failure: surface the jsonnet message with context\n\t\treturn fmt.Errorf(\"invalid jsonnet snippet: %w\", err)\n\t}\n\treturn fmt.Errorf(\"worker/pool failure: %w\", err)\n}","preventionTips":["Lint jsonnet snippets with `jsonnet fmt --no-seq` or jsonnet-lint in CI before evaluating","Keep snippets free of std.extVar / imports unless the pool VM is configured to allow them","Pin the jsonnet library version and test snippets against the same version locally","Wrap eval calls with context about which config file produced the snippet for faster triage"],"tags":["jsonnet","evaluation","sandbox"],"backgroundTag":"jsonnet-evaluation-error","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}