{"record":{"id":"cc34bb9527e0f244","repo":"ory/hydra","slug":"failed-to-read-from-stdin","errorCode":null,"errorMessage":"failed to read from stdin","messagePattern":"failed to read from stdin","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/cmd.go","lineNumber":55,"sourceCode":"\t\t\t// and write JSON to stdout/stderr. Denying all path-based\n\t\t\t// filesystem access prevents a malicious snippet from\n\t\t\t// touching the operator's file system even if the\n\t\t\t// jsonnet VM ever exposed a path-import primitive.\n\t\t\tif err := landlockx.ApplyEmpty(nil); err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to apply empty landlock sandbox\")\n\t\t\t}\n\n\t\t\t// This could fail because current limits are lower than what we tried to set,\n\t\t\t// so we still continue in this case.\n\t\t\tSetVirtualMemoryLimit(virtualMemoryLimitBytes)\n\n\t\t\tif null {\n\t\t\t\treturn scan(cmd.OutOrStdout(), cmd.InOrStdin())\n\t\t\t}\n\n\t\t\tinput, err := io.ReadAll(cmd.InOrStdin())\n\t\t\tif err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to read from stdin\")\n\t\t\t}\n\n\t\t\tjson, err := eval(input)\n\t\t\tif err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to evaluate jsonnet\")\n\t\t\t}\n\n\t\t\tif _, err := io.WriteString(cmd.OutOrStdout(), json); err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to write json output\")\n\t\t\t}\n\t\t\treturn nil\n\t\t},\n\t}\n\tcmd.Flags().BoolVarP(&null, \"null\", \"0\", false,\n\t\t`Read multiple snippets and parameters from stdin separated by null bytes.\nOutput will be in the same order as inputs, separated by null bytes.\nEvaluation errors will also be reported to stdout, separated by null bytes.\nNon-recoverable errors are written to stderr and the program will terminate with a non-zero exit code.`)","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/cmd.go#L37-L73","documentation":"Returned by the jsonnet CLI's RunE when reading the jsonnet snippet (or parameters) from stdin fails. Stdin is the worker's only input channel under the Landlock sandbox; a read error means the pipe was closed early or the harness misused the worker.","triggerScenarios":"Thrown at oryx/jsonnetsecure/cmd.go:55 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the caller writes the full input and keeps stdin open until EOF","Check the wrapped io error for pipe-closed or I/O timeout causes","Verify the harness spawns the worker with stdin correctly wired"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}