{"record":{"id":"3f52e3bcf91136b5","repo":"dagger/dagger","slug":"knownhosts-is-required-unless-insecureskiphostkeyc","errorCode":null,"errorMessage":"knownHosts is required unless insecureSkipHostKeyCheck is true","messagePattern":"knownHosts is required unless insecureSkipHostKeyCheck is true","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/schema/volume.go","lineNumber":96,"sourceCode":"type sshfsVolumeArgs struct {\n\tEndpoint                 string\n\tPrivateKey               core.SecretID\n\tKnownHosts               dagql.Optional[core.SecretID]\n\tCacheKey                 dagql.Optional[dagql.String]\n\tInsecureSkipHostKeyCheck bool `default:\"false\"`\n\tExperimentalServiceHost  dagql.Optional[core.ServiceID]\n}\n\nfunc (s *volumeSchema) sshfsVolume(ctx context.Context, parent dagql.ObjectResult[*core.Query], args sshfsVolumeArgs) (dagql.ObjectResult[*core.Volume], error) {\n\tif err := parent.Self().RequireMainClient(ctx); err != nil {\n\t\treturn dagql.ObjectResult[*core.Volume]{}, err\n\t}\n\tendpoint, hostKeyAlias, err := parseSSHFSVolumeEndpoint(args.Endpoint)\n\tif err != nil {\n\t\treturn dagql.ObjectResult[*core.Volume]{}, err\n\t}\n\tif !args.KnownHosts.Valid && !args.InsecureSkipHostKeyCheck {\n\t\treturn dagql.ObjectResult[*core.Volume]{}, fmt.Errorf(\"knownHosts is required unless insecureSkipHostKeyCheck is true\")\n\t}\n\n\tsrv, err := core.CurrentDagqlServer(ctx)\n\tif err != nil {\n\t\treturn dagql.ObjectResult[*core.Volume]{}, err\n\t}\n\tprivateKey, err := args.PrivateKey.Load(ctx, srv)\n\tif err != nil {\n\t\treturn dagql.ObjectResult[*core.Volume]{}, fmt.Errorf(\"load volume private key: %w\", err)\n\t}\n\tvar knownHosts dagql.ObjectResult[*core.Secret]\n\tif args.KnownHosts.Valid {\n\t\tknownHosts, err = args.KnownHosts.Value.Load(ctx, srv)\n\t\tif err != nil {\n\t\t\treturn dagql.ObjectResult[*core.Volume]{}, fmt.Errorf(\"load volume known hosts: %w\", err)\n\t\t}\n\t}\n\tvar serviceHost dagql.ObjectResult[*core.Service]","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/core/schema/volume.go#L78-L114","documentation":"Input validation error in sshfsVolume: creating an SSHFS-backed volume requires either an explicit knownHosts secret (SSH host key pins) or the explicit opt-out insecureSkipHostKeyCheck=true. Dagger refuses to silently skip host key verification.","triggerScenarios":"Calling Query.sshfsVolume (experimental) with no knownHosts secret and insecureSkipHostKeyCheck left at its default false.","commonSituations":"Quick experiment scripts omitting host key material; migrations from plain SSH mounts; SDK code copied without the knownHosts argument.","solutions":["Pass a knownHosts secret containing the server's SSH host keys","Set insecureSkipHostKeyCheck: true to explicitly skip verification (dev only)","Generate the known hosts entry via `ssh-keyscan <host>` and register it as a secret","Verify the argument name/spelling in the SDK you are using"],"exampleFix":"// before\nquery.sshfsVolume({ endpoint: \"user@host:/path\", privateKey: key })\n// after\nconst knownHosts = await client.setSecret(\"kh\", knownHostsText)\nquery.sshfsVolume({ endpoint: \"user@host:/path\", privateKey: key, knownHosts })","handlingStrategy":"validation","validationCode":"if (!knownHostsSecret && !insecureSkipHostKeyCheck) { throw new Error('provide knownHosts or set insecureSkipHostKeyCheck=true before calling sshfsVolume') }","typeGuard":null,"tryCatchPattern":"try { client.sshfsVolume(args) } catch (e) { if (String(e).includes('knownHosts is required')) { /* fix args and retry */ } throw e }","preventionTips":["Always supply a knownHosts secret built from `ssh-keyscan`","Use insecureSkipHostKeyCheck only in throwaway dev environments","Wrap sshfsVolume calls in a helper that enforces the host-key policy"],"tags":["validation","sshfs","volume","security"],"backgroundTag":"missing-required-argument","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}