{"record":{"id":"b9aa679b8eddc2d1","repo":"ory/kratos","slug":"could-not-read-schema-file-w","errorCode":null,"errorMessage":"could not read schema file: %w","messagePattern":"could not read schema file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"schema/handler.go","lineNumber":236,"sourceCode":"\t\tss[i] = identitySchemaContainer{\n\t\t\tID:     schema.ID,\n\t\t\tSchema: raw,\n\t\t}\n\t}\n\n\tx.PaginationHeader(w, *r.URL, int64(total), page, itemsPerPage)\n\th.r.Writer().Write(w, r, ss)\n}\n\nfunc (h *Handler) ReadSchema(ctx context.Context, uri *url.URL) (data []byte, err error) {\n\tctx, span := h.r.Tracer(ctx).Tracer().Start(ctx, \"schema.Handler.ReadSchema\")\n\tdefer otelx.End(span, &err)\n\n\tswitch uri.Scheme {\n\tcase \"file\":\n\t\tdata, err = os.ReadFile(uri.Host + uri.Path) //nolint:gosec\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(fmt.Errorf(\"could not read schema file: %w\", err))\n\t\t}\n\tcase \"base64\":\n\t\tdata, err = base64.StdEncoding.DecodeString(strings.TrimPrefix(uri.String(), \"base64://\"))\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(fmt.Errorf(\"could not decode schema file: %w\", err))\n\t\t}\n\tdefault:\n\t\treq, err := retryablehttp.NewRequestWithContext(ctx, http.MethodGet, uri.String(), nil)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(fmt.Errorf(\"could not create request: %w\", err))\n\t\t}\n\t\tresp, err := h.r.HTTPClient(ctx).Do(req)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(herodot.ErrUpstreamError().WithReason(\"could not fetch schema\").WithError(err.Error()).WithDetail(\"uri\", uri))\n\t\t}\n\t\tdefer func() { _ = resp.Body.Close() }()\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\tif resp.StatusCode == http.StatusNotFound {","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/schema/handler.go#L218-L254","documentation":"ReadSchema loads an identity JSON schema from a URI. For file:// URIs it reads the file from disk with os.ReadFile; if the OS open/read fails (missing file, permission denied, wrong path), the error is wrapped as \"could not read schema file\".","triggerScenarios":"Identity schema configured as file:///path/to/schema.json where the file does not exist, the path is wrong (note: only the default scheme's empty path yields \"\"), permission bits block the process, or the path is a directory.","commonSituations":"Relative path resolved against a different working directory in containers; config pointing at the dev machine path inside Docker; file deleted after mount; read-only filesystem or missing volume mount.","solutions":["Verify the file exists at the exact absolute path (file:// + absolute path, e.g. file:///etc/kratos/identity.schema.json)","Check read permissions for the process user","In containers, confirm the schema is copied/mounted into the image or volume","Check the wrapped inner error message — it names the exact OS-level cause (no such file, permission denied)"],"exampleFix":"// before\n\"identity_schemas\": {\"default\": {\"file://schemas/identity.schema.json\"}}\n// after\n\"identity_schemas\": {\"default\": {\"file:///etc/config/identity.schema.json\"}}","handlingStrategy":"validation","validationCode":"// Go: preflight a file:// schema URI\nfunc schemaFileReadable(raw string) error {\n\tu, err := url.Parse(raw)\n\tif err != nil || u.Scheme != \"file\" {\n\t\treturn fmt.Errorf(\"not a file URI: %s\", raw)\n\t}\n\tpath := u.Host + u.Path\n\tfi, err := os.Stat(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"schema file missing: %w\", err)\n\t}\n\tif fi.IsDir() {\n\t\treturn fmt.Errorf(\"schema path is a directory: %s\", path)\n\t}\n\tf, err := os.Open(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"schema file not readable: %w\", err)\n\t}\n\treturn f.Close()\n}","typeGuard":null,"tryCatchPattern":"schema, err := h.ReadSchema(ctx, uri)\nif err != nil {\n\tvar pathErr *os.PathError\n\tif errors.As(err, &pathErr) {\n\t\treturn fmt.Errorf(\"identity schema %s unreadable: %v — check path/permissions\", uri, pathErr.Err)\n\t}\n\treturn err\n}","preventionTips":["Use absolute paths in file:// URIs inside containers","Mount or COPY the schema into the container image","Check os.Stat on the exact path in an entrypoint preflight script","Keep schema files alongside config with matching deploy artifacts"],"tags":["filesystem","schema","configuration"],"backgroundTag":"file-read-failed","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}