{"record":{"id":"c7e8969aaa7cdd6d","repo":"hashicorp/terraform","slug":"failed-to-create-temp-known-hosts-file-s","errorCode":null,"errorMessage":"failed to create temp known_hosts file: %s","messagePattern":"failed to create temp known_hosts file: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/provisioner.go","lineNumber":339,"sourceCode":"\tpassword    string\n\tsshAgent    *sshAgent\n\tcertificate string\n\tuser        string\n\thost        string\n\thostKey     string\n}\n\nfunc buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) {\n\thkCallback := ssh.InsecureIgnoreHostKey()\n\n\tif opts.hostKey != \"\" {\n\t\t// The knownhosts package only takes paths to files, but terraform\n\t\t// generally wants to handle config data in-memory. Rather than making\n\t\t// the known_hosts file an exception, write out the data to a temporary\n\t\t// file to create the HostKeyCallback.\n\t\ttf, err := ioutil.TempFile(\"\", \"tf-known_hosts\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create temp known_hosts file: %s\", err)\n\t\t}\n\t\tdefer tf.Close()\n\t\tdefer os.RemoveAll(tf.Name())\n\n\t\t// we mark this as a CA as well, but the host key fallback will still\n\t\t// use it as a direct match if the remote host doesn't return a\n\t\t// certificate.\n\t\tif _, err := tf.WriteString(fmt.Sprintf(\"@cert-authority %s %s\\n\", opts.host, opts.hostKey)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to write temp known_hosts file: %s\", err)\n\t\t}\n\t\ttf.Sync()\n\n\t\thkCallback, err = knownhosts.New(tf.Name())\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/provisioner.go#L321-L357","documentation":"Raised in buildSSHClientConfig when ioutil.TempFile(\"\", \"tf-known_hosts\") fails while setting up host key verification. When a host_key is configured, the communicator writes it to a temp file because the knownhosts package requires a file path. If the OS cannot create that temp file, host key verification cannot be set up and the error is returned.","triggerScenarios":"A connection block with host_key set triggers temp file creation for the known_hosts data. The OS fails to create the file in the system temp directory.","commonSituations":"The system temp directory is full, out of inodes, read-only, or the process lacks permission. Common in locked-down containers, CI runners under disk pressure, or when TMPDIR is misconfigured.","solutions":["Check available disk space and inodes in the temp directory (df -h, df -i).","Ensure the process has write permission to TMPDIR.","Set TMPDIR to a writable location with adequate space.","If host_key verification is not strictly needed, consider removing the host_key attribute (note: this reduces security)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate temp directory writability before setting up host key verification\nfunc validateTempDirForKnownHosts() error {\n    tf, err := ioutil.TempFile(\"\", \"tf-known_hosts-test\")\n    if err != nil {\n        return fmt.Errorf(\"cannot create temp file for known_hosts: %w\", err)\n    }\n    tf.Close()\n    os.Remove(tf.Name())\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set TMPDIR to a writable directory with adequate space.","In containers, ensure /tmp is writable and not a read-only mount.","Monitor disk space on the runner before starting terraform."],"tags":["ssh","host-key","temp-file","known-hosts","disk-space","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}