{"record":{"id":"c2df7580f0d870cb","repo":"cloudflare/cloudflared","slug":"error-validating-unix-socket","errorCode":null,"errorMessage":"Error validating --unix-socket","messagePattern":"Error validating --unix-socket","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":185,"sourceCode":"\tif c.IsSet(config.BastionFlag) {\n\t\treturn newBastionService(), nil\n\t}\n\tif c.IsSet(\"url\") {\n\t\toriginURL, err := config.ValidateUrl(c, allowURLFromArgs)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Error validating origin URL\")\n\t\t}\n\t\tif isHTTPService(originURL) {\n\t\t\treturn &httpService{\n\t\t\t\turl: originURL,\n\t\t\t}, nil\n\t\t}\n\t\treturn newTCPOverWSService(originURL), nil\n\t}\n\tif c.IsSet(\"unix-socket\") {\n\t\tpath, err := config.ValidateUnixSocket(c)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Error validating --unix-socket\")\n\t\t}\n\t\treturn &unixSocketPath{path: path, scheme: \"http\"}, nil\n\t}\n\treturn nil, ErrNoIngressRulesCLI\n}\n\n// IsEmpty checks if there are any ingress rules.\nfunc (ing Ingress) IsEmpty() bool {\n\treturn len(ing.Rules) == 0\n}\n\n// IsSingleRule checks if the user only specified a single ingress rule.\nfunc (ing Ingress) IsSingleRule() bool {\n\treturn len(ing.Rules) == 1\n}\n\n// StartOrigins will start any origin services managed by cloudflared, e.g. proxy servers or Hello World.\nfunc (ing Ingress) StartOrigins(","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L167-L203","documentation":"parseSingleOriginService validates the --unix-socket flag with config.ValidateUnixSocket and wraps failures as 'Error validating --unix-socket'. The flag value must resolve to a valid local unix socket path that cloudflared can proxy HTTP requests over.","triggerScenarios":"Running cloudflared with `--unix-socket <path>` where the path fails validation: empty value, invalid path characters, or a path that does not name a usable unix domain socket for the origin service.","commonSituations":"Pointing --unix-socket at a regular file or a directory instead of a socket, the origin service not yet having created the socket, typos in the path, or permission problems on the socket path.","solutions":["Verify the socket file exists: ls -l <path> should show type 's' before starting cloudflared (or start the origin first).","Pass an absolute path to the socket, not a relative one.","Ensure the user running cloudflared has read/write permission on the socket.","Use --url instead if the origin is served over TCP rather than a unix socket."],"exampleFix":"// before\ncloudflared tunnel --unix-socket ./app.sock\n// after\ncloudflared tunnel --unix-socket /run/myapp/app.sock","handlingStrategy":"validation","validationCode":"// Go: verify the socket exists and is a socket before passing --unix-socket\nfi, err := os.Stat(sockPath)\nif err != nil || fi.Mode()&os.ModeSocket == 0 {\n\t// path missing or not a unix socket; start the origin first or fix the path\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Start the origin service before cloudflared so the socket file exists.","Use absolute socket paths under a writable runtime directory (e.g. /run).","Ensure the cloudflared user has read/write permission on the socket.","Confirm the file is actually a socket (mode 's') rather than a regular file."],"tags":["cli","unix-socket","ingress","config","cloudflare"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}