{"record":{"id":"bcc04e4ebe88e9b5","repo":"cloudflare/cloudflared","slug":"failed-to-generate-lock-id-w","errorCode":null,"errorMessage":"failed to generate lock ID: %w","messagePattern":"failed to generate lock ID: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":268,"sourceCode":"\tp, err := process.NewProcess(pid)\n\tif err != nil {\n\t\treturn lockContent{}, fmt.Errorf(\"failed to look up own process: %w\", err)\n\t}\n\tct, err := p.CreateTime()\n\tif err != nil {\n\t\treturn lockContent{}, fmt.Errorf(\"failed to get own start time: %w\", err)\n\t}\n\tid, err := newLockID()\n\tif err != nil {\n\t\treturn lockContent{}, err\n\t}\n\treturn lockContent{PID: pid, StartTime: ct, ID: id}, nil\n}\n\nfunc newLockID() (string, error) {\n\tvar b [16]byte\n\tif _, err := rand.Read(b[:]); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate lock ID: %w\", err)\n\t}\n\treturn hex.EncodeToString(b[:]), nil\n}\n\n// isLockFileStale reads the lock file and checks whether the owning process\n// is dead or has a mismatched start time. Returns (true, content, nil) if\n// stale, (false, content, nil) if actively held, or an error if the file\n// cannot be read.\nfunc isLockFileStale(path string) (bool, lockContent, error) {\n\tdata, err := os.ReadFile(path) // nolint: gosec\n\tif err != nil {\n\t\treturn false, lockContent{}, err\n\t}\n\tvar content lockContent\n\tif err := json.Unmarshal(data, &content); err != nil {\n\t\t// corrupt or empty file (treat as stale)\n\t\treturn true, lockContent{}, nil\n\t}","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L250-L286","documentation":"newLockID wraps crypto/rand.Read failure while generating the 16-byte random identifier written into the lock file. The lock ID uniquely identifies the lock holder; without it the library cannot safely create the lock content, so it aborts. crypto/rand.Read effectively only fails when the OS entropy source is unavailable.","triggerScenarios":"Called from newSelfLockContent during createLockFile when the operating system's cryptographic RNG fails — e.g. /dev/urandom unusable or getrandom(2) syscall blocked by seccomp in a sandboxed container.","commonSituations":"Highly restricted sandboxes (gVisor, Firecracker minimal images, embedded Linux) where /dev/urandom is missing or the getrandom syscall is filtered; extremely early boot before entropy init on old kernels.","solutions":["Check the wrapped %w error to identify the OS-level RNG failure (e.g. open /dev/urandom: no such file).","Ensure /dev/urandom exists in the container/image (mount it if the base image omits it).","Review seccomp/AppArmor filters and allow the getrandom(2) syscall.","Update Go toolchain — modern Go uses getrandom(2) and virtually never fails after kernel 3.17 boot."],"exampleFix":"// before\ngo test ./token/... // fails in sandbox with 'failed to generate lock ID'\n// after: docker run with default (unfiltered) seccomp and /dev/urandom\ndocker run --security-opt seccomp=default.json --tmpfs /dev:rw ...","handlingStrategy":"retry","validationCode":"var probe [16]byte\nif _, err := rand.Read(probe[:]); err != nil {\n    // OS entropy source unavailable; lock ID generation will fail\n}","typeGuard":null,"tryCatchPattern":"content, err := createLockFile(path)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to generate lock ID\") {\n        // transient OS RNG failure: retry once after short delay\n        time.Sleep(50 * time.Millisecond)\n        return createLockFile(path)\n    }\n    return err\n}","preventionTips":["Do not filter the getrandom(2) syscall in sandboxes/seccomp profiles.","Ensure /dev/urandom exists in minimal container images.","Use a recent Go toolchain where crypto/rand virtually never fails.","Retry once on failure before surfacing the error to the user."],"tags":["go","crypto","random","lockfile"],"backgroundTag":"file-open-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}