{"record":{"id":"5dd861026718fbf3","repo":"dagger/dagger","slug":"failed-to-evaluate-symlinks-for-s-w","errorCode":null,"errorMessage":"failed to evaluate symlinks for %s: %w","messagePattern":"failed to evaluate symlinks for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/engineutil/cacerts/distros.go","lineNumber":54,"sourceCode":"the same pattern for CA certs though. It's named debianLike\nfor lack of a better name :-)\n*/\ntype debianLike struct {\n\t*commonInstaller\n}\n\nfunc (d *debianLike) initialize(ctrFS *containerfs.ContainerFS) error {\n\tbundlePath := \"/etc/ssl/certs/ca-certificates.crt\"\n\tresolvedBundlePath, err := ctrFS.EvaluateSymlinks(bundlePath)\n\tswitch {\n\tcase err == nil:\n\t\tbundlePath = resolvedBundlePath\n\tcase errors.Is(err, os.ErrNotExist):\n\t\t// didn't exist, ignore\n\tcase errors.Is(err, unix.EINVAL):\n\t\t// not a symlink, ignore\n\tdefault:\n\t\treturn fmt.Errorf(\"failed to evaluate symlinks for %s: %w\", bundlePath, err)\n\t}\n\n\td.commonInstaller = &commonInstaller{\n\t\tctrFS:           ctrFS,\n\t\tbundlePath:      bundlePath,\n\t\tcustomCACertDir: \"/usr/local/share/ca-certificates\",\n\t\tupdateCmd:       []string{\"update-ca-certificates\"},\n\t}\n\n\treturn nil\n}\n\nfunc (d *debianLike) detect() (bool, error) {\n\tif exists, err := d.ctrFS.AnyPathExists([]string{\n\t\t\"/etc/debian_version\",\n\t\t\"/etc/alpine-release\",\n\t\t\"/etc/gentoo-release\",\n\t}); err != nil {","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/engineutil/cacerts/distros.go#L36-L72","documentation":"debianLike.initialize resolves the CA bundle path /etc/ssl/certs/ca-certificates.crt through ContainerFS.EvaluateSymlinks before configuring commonInstaller. ErrNotExist and EINVAL (not a symlink) are tolerated, but any other error while resolving symlinks is fatal and wrapped with this message.","triggerScenarios":"ctrFS.EvaluateSymlinks(\"/etc/ssl/certs/ca-certificates.crt\") returns an error other than os.ErrNotExist or unix.EINVAL during CA cert installation in a debian/alpine/wolfi/gentoo container.","commonSituations":"Permission errors walking /etc/ssl/certs in a rootless or restricted container; corrupted or looping symlinks (ELOOP); I/O errors on an unhealthy overlay snapshot; unusual images where the path is a directory or otherwise odd.","solutions":["Inspect the wrapped cause (%w) — fix the underlying filesystem error (permissions, ELOOP, I/O)","Verify /etc/ssl/certs is readable inside the container image","Rebuild or pull a fresh copy of the base image if its /etc/ssl is corrupted","Check that no custom mounts/SDK manipulations are making the bundle path unresolvable"],"exampleFix":"// before: broken symlink loop in image\nRUN ln -s ca-certificates.crt /etc/ssl/certs/ca-certificates.crt\n// after: real file or valid symlink\nRUN ln -sf /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # ensure target exists","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := os.Lstat(\"/etc/ssl/certs\"); err != nil {\n    return fmt.Errorf(\"container /etc/ssl/certs unusable: %w\", err)\n}\n// on wrapped \"failed to evaluate symlinks\": inspect errors.Is(err, unix.ELOOP), fs.ErrPermission","preventionTips":["Use stock base images with intact /etc/ssl/certs","Avoid symlink loops when customizing /etc/ssl","Verify image filesystem health after heavy snapshot/copy operations","Run containers with sufficient privileges to traverse /etc/ssl"],"tags":["filesystem","symlink","ca-certificates","container"],"backgroundTag":"symlink-resolution-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}