{"record":{"id":"7d14c6fda0880d55","repo":"quarkusio/quarkus","slug":"failed-to-open-directorystream-for-configured-cert","errorCode":null,"errorMessage":"Failed to open DirectoryStream for configured certificate path + certificateDirectory","messagePattern":"Failed to open DirectoryStream for configured certificate path \\+ certificateDirectory","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java","lineNumber":106,"sourceCode":"\n        return options;\n    }\n\n    private static DirectoryStream<Path> streamDirectory(Path certificateDirectory) {\n        if (Files.notExists(certificateDirectory)) {\n            throw new ConfigurationException(\"Configured certificate path does not exist:\" + certificateDirectory);\n        }\n\n        if (!Files.isDirectory(certificateDirectory)) {\n            throw new ConfigurationException(\"Path '\" + certificateDirectory + \"' is not a directory. Paths pointing \"\n                    + \"to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property\"\n                    + \" instead\");\n        }\n\n        try {\n            return Files.newDirectoryStream(certificateDirectory);\n        } catch (IOException e) {\n            throw new RuntimeException(\"Failed to open DirectoryStream for configured certificate path \" + certificateDirectory,\n                    e);\n        }\n    }\n}\n","sourceCodeStart":88,"sourceCodeEnd":111,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java#L88-L111","documentation":"streamDirectory calls Files.newDirectoryStream to open the certificate directory; an IOException while opening is wrapped in a RuntimeException 'Failed to open DirectoryStream for configured certificate path <path>'. This means the path exists and is a directory, but the JVM could not open it for listing.","triggerScenarios":"Files.newDirectoryStream throwing IOException on a certDir configured via quarkus.tls.<name>.pem.certDirs — permission denied, I/O error, or the path was removed between the isDirectory check and the open (race).","commonSituations":"Running as a non-root container user without read permission on the mounted certs directory; disk I/O errors; directory deleted by a concurrent process; SELinux/AppArmor denial on the path.","solutions":["Check the chained IOException cause (usually FileSystemException with reason)","Fix filesystem permissions so the process user can read/list the directory","Verify the directory still exists at startup and no cleanup job removes it concurrently","Check container security policies (SELinux/AppArmor) that could block the path"],"exampleFix":"# before (permission denied)\n# after, in Dockerfile\nCOPY --chown=185:185 certs /deployments/certs\nRUN chmod -R u+rX /deployments/certs","handlingStrategy":"validation","validationCode":"for (Path dir : certDirs) {\n    if (!Files.isDirectory(dir)) throw new IllegalStateException(\"Not a directory: \" + dir);\n    if (!Files.isReadable(dir)) throw new IllegalStateException(\"Not readable: \" + dir);\n    try (var s = Files.list(dir)) { s.findAny(); } // probe open\n}\n","typeGuard":"static boolean canOpenDirectoryStream(Path dir) {\n    if (!Files.isDirectory(dir)) return false;\n    try (var s = Files.newDirectoryStream(dir)) { return true; }\n    catch (IOException e) { return false; }\n}","tryCatchPattern":"try {\n    options = pemCertsConfig.toOptions();\n} catch (RuntimeException e) {\n    if (e.getCause() instanceof java.nio.file.AccessDeniedException ade)\n        log.error(\"Permission denied opening cert dir: \" + ade.getFile());\n    throw e;\n}","preventionTips":["Grant the runtime user read+execute on cert directories","Check SELinux/AppArmor labels on mounted cert paths","Avoid racing directory cleanup with application startup","Test startup as the same user the container runs as"],"tags":["quarkus","tls-registry","io","permissions","filesystem"],"backgroundTag":"directory-stream-io-error","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}