{"record":{"id":"49f371d7ad8a3b03","repo":"hashicorp/nomad","slug":"failed-to-open-auth-config-file-v-error-v","errorCode":null,"errorMessage":"Failed to open auth config file: %v, error: %v","messagePattern":"Failed to open auth config file: (.+?), error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/utils.go","lineNumber":69,"sourceCode":"\t\ttag = \"\"\n\t}\n\n\treturn repo, tag, nil\n}\n\nfunc dockerImageRef(repo string, tag string) string {\n\tif tag == \"\" {\n\t\treturn repo\n\t}\n\treturn fmt.Sprintf(\"%s:%s\", repo, tag)\n}\n\n// loadDockerConfig loads the docker config at the specified path, returning an\n// error if it couldn't be read.\nfunc loadDockerConfig(file string) (*configfile.ConfigFile, error) {\n\tf, err := os.Open(file)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to open auth config file: %v, error: %v\", file, err)\n\t}\n\tdefer f.Close()\n\n\tcfile := new(configfile.ConfigFile)\n\tif err = cfile.LoadFromReader(f); err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to parse auth config file: %v\", err)\n\t}\n\treturn cfile, nil\n}\n\n// repositoryInfo contains the subset of repository metadata needed for auth\n// lookup against Docker config files and credential helpers.\ntype repositoryInfo struct {\n\tIndex *registrytypes.IndexInfo\n}\n\n// parseRepositoryInfo takes a repo and returns the repository metadata needed\n// for interacting with a Docker config object.","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/utils.go#L51-L87","documentation":"loadDockerConfig opens the Docker auth config file (e.g. config.json) at a given path. If os.Open fails, the error is wrapped as 'Failed to open auth config file' including the path and OS error. This happens before parsing, so the file could not be read at all.","triggerScenarios":"Calling loadDockerConfig(file) when the file does not exist, the path is wrong, or the Nomad agent process lacks read permission on the file or its directory.","commonSituations":"DOCKER_AUTH_CONFIG / docker.config path misconfigured; file deleted or rotated after registration; agent running as a user without access to the user's ~/.docker/config.json; SELinux/AppArmor blocking the read.","solutions":["Verify the auth config path exists and is readable by the Nomad agent user (ls -l, test with sudo -u nomad cat)","Fix the docker.auth.config path in the client plugin configuration","Correct file ownership/permissions (chown/chmod) or SELinux context on the file","If the file was meant to be optional, ensure the caller checks existence before invoking"],"exampleFix":"# before\nsudo -u nomad cat /home/me/.docker/config.json  # Permission denied\n# after\nsudo chown nomad:nomad /home/me/.docker/config.json && chmod 600 /home/me/.docker/config.json","handlingStrategy":"validation","validationCode":"const authCfg = \"/etc/nomad.d/docker-auth.json\"\nif fi, err := os.Stat(authCfg); err != nil || fi.Mode().Perm()&0o400 == 0 {\n    return fmt.Errorf(\"auth config %s missing or unreadable by agent user\", authCfg)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ship the auth config with correct ownership (nomad:nomad, mode 0600)","Verify readability as the agent user during provisioning","Keep the path stable; avoid pointing at volatile per-user ~/.docker paths","Account for SELinux/AppArmor policies on config directories"],"tags":["docker","auth","config-file","permissions"],"backgroundTag":"auth-config-file-unreadable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}