{"record":{"id":"bddc4da53cb936c5","repo":"GoogleContainerTools/skaffold","slug":"unable-to-open-provided-file-s","errorCode":null,"errorMessage":"unable to open provided file %s","messagePattern":"unable to open provided file (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/skaffold/app/cmd/apply.go","lineNumber":75,"sourceCode":"func doApply(ctx context.Context, out io.Writer, args []string) error {\n\t// force set apply boolean to select default options in runner creation\n\topts.Apply = true\n\topts.HydratedManifests = args\n\tif err := validateManifests(args); err != nil {\n\t\treturn err\n\t}\n\treturn withRunner(ctx, out, func(r runner.Runner, configs []util.VersionedConfig) error {\n\t\treturn r.Apply(ctx, out)\n\t})\n}\n\nfunc validateManifests(manifests []string) error {\n\tfor _, m := range manifests {\n\t\tif _, err := os.Open(m); err != nil {\n\t\t\tif errors.Is(err, os.ErrNotExist) {\n\t\t\t\treturn fmt.Errorf(\"cannot find provided file %s\", m)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unable to open provided file %s\", m)\n\t\t}\n\n\t\tif _, err := kubernetes.ParseKubernetesObjects(m); err != nil {\n\t\t\treturn errors.Wrap(err, fmt.Sprintf(\"%s is not a valid Kubernetes manifest\", m))\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":57,"sourceCodeEnd":84,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/cmd/skaffold/app/cmd/apply.go#L57-L84","documentation":"In `skaffold apply` (cmd/skaffold/app/cmd/apply.go:75), validateManifests tries to open each provided manifest file; if os.Open fails with any error other than os.ErrNotExist (permission denied, path is a directory, I/O error), this error is returned.","triggerScenarios":"Running `skaffold apply` with a manifest path that exists but cannot be opened: read permission denied for the current user, the path is a directory, or a device/IO error occurs during open.","commonSituations":"Manifest owned by root with 0600 permissions while running as a non-root CI user; passing a directory instead of a file; an unreadable mounted volume in a containerized CI runner; SELinux/AppArmor blocking access.","solutions":["Fix file permissions (chmod/chown) so the user running skaffold can read the manifest","Verify the path is a regular file, not a directory (`file <path>`)","Run the command as a user with access to the file, or copy it to an accessible location","Check OS-level access controls (SELinux denials, container mount options) if permissions look correct"],"exampleFix":"// before: unreadable manifest\n// -rw------- root root manifests/deployment.yaml\n// after\n// chmod 644 manifests/deployment.yaml  # then rerun skaffold apply","handlingStrategy":"validation","validationCode":"// Before apply, ensure manifests are readable regular files\ninfo, err := os.Stat(m)\nif err != nil || info.IsDir() {\n    return fmt.Errorf(\"not a readable file: %s\", m)\n}\nif f, err := os.Open(m); err != nil {\n    return fmt.Errorf(\"no read permission: %s (%v)\", m, err)\n} else {\n    f.Close()\n}","typeGuard":null,"tryCatchPattern":"if err := sh.Run(\"skaffold\", \"apply\", \"--filepath\", m); err != nil {\n    if strings.Contains(err.Error(), \"unable to open provided file\") {\n        log.Fatalf(\"cannot open %s: check permissions and that it is a file\", m)\n    }\n    return err\n}","preventionTips":["Ensure CI user has read access to all manifest files (chmod 644)","Never point --filepath at a directory","Verify volume mounts in CI containers expose manifests read-only but readable","Check SELinux/AppArmor contexts on shared manifest directories"],"tags":["cli","apply","permissions","manifest"],"backgroundTag":"permission-denied","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}