{"record":{"id":"7969526c0d20721c","repo":"hashicorp/nomad","slug":"failed-to-open-source-file-q-w","errorCode":null,"errorMessage":"failed to open source file %q: %w","messagePattern":"failed to open source file %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/template/renderer/z_template_render.go","lineNumber":89,"sourceCode":"func readTemplate() error {\n\tvar (\n\t\tsandboxPath, sourcePath string\n\t\terr                     error\n\t)\n\n\tflags := flag.NewFlagSet(\"template-render\", flag.ExitOnError)\n\tflags.StringVar(&sandboxPath, \"sandbox-path\", \"\", \"\")\n\tflags.StringVar(&sourcePath, \"source-path\", \"\", \"\")\n\tflags.Parse(os.Args[3:])\n\n\tsourcePath, err = sandbox(sandboxPath, sourcePath) // platform-specific sandboxing\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to sandbox alloc dir %q: %w\", sandboxPath, err)\n\t}\n\n\tf, err := os.Open(sourcePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open source file %q: %w\", sourcePath, err)\n\t}\n\tdefer f.Close()\n\n\t_, err = io.Copy(os.Stdout, f)\n\treturn err\n}\n\nfunc writeTemplate() (*renderer.RenderResult, error) {\n\n\tvar (\n\t\tsandboxPath, destPath, perms, user, group string\n\t)\n\n\tflags := flag.NewFlagSet(\"template-render\", flag.ExitOnError)\n\tflags.StringVar(&sandboxPath, \"sandbox-path\", \"\", \"\")\n\tflags.StringVar(&destPath, \"dest-path\", \"\", \"\")\n\tflags.StringVar(&perms, \"perms\", \"\", \"\")\n\tflags.StringVar(&user, \"user\", \"\", \"\")","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/template/renderer/z_template_render.go#L71-L107","documentation":"In the unprivileged template-render child process, readTemplate failed to os.Open the template's source file after sandbox path validation, typically because the path escaped the sandbox or the file does not exist; rendering aborts.","triggerScenarios":"Thrown at client/allocrunner/taskrunner/template/renderer/z_template_render.go:89 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the template source path exists in the alloc dir","Check the path is not rejected by sandbox validation","Check file permissions for the template runner user"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}