{"record":{"id":"d17a46c57e7ebf67","repo":"hashicorp/nomad","slug":"failed-to-create-secrets-envoy-bootstrap-json-for","errorCode":null,"errorMessage":"failed to create secrets/envoy_bootstrap.json for envoy: %w","messagePattern":"failed to create secrets/envoy_bootstrap\\.json for envoy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/envoy_bootstrap_hook.go","lineNumber":374,"sourceCode":"\n\t// Since Consul services are registered asynchronously with this task\n\t// hook running, retry until timeout or success.\n\tbackoffErr := decay.Backoff(func() (bool, error) {\n\t\t// If hook is killed, just stop.\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\treturn false, nil\n\t\tdefault:\n\t\t}\n\n\t\t// Prepare bootstrap command to run.\n\t\tcmd := exec.CommandContext(ctx, \"consul\", bootstrapArgs...)\n\t\tcmd.Env = bootstrapEnv\n\n\t\t// Redirect stdout to secrets/envoy_bootstrap.json.\n\t\tstdout, fileErr := os.Create(bootstrapFilePath)\n\t\tif fileErr != nil {\n\t\t\treturn false, fmt.Errorf(\"failed to create secrets/envoy_bootstrap.json for envoy: %w\", fileErr)\n\t\t}\n\t\tdefer stdout.Close()\n\t\tcmd.Stdout = stdout\n\n\t\t// Redirect stderr into another file for later debugging.\n\t\tstderr, fileErr := os.OpenFile(bootstrapStderrPath, os.O_RDWR|os.O_CREATE, 0644)\n\t\tif fileErr != nil {\n\t\t\treturn false, fmt.Errorf(\"failed to create alloc/logs/envoy_bootstrap.stderr.0 for envoy: %w\", fileErr)\n\t\t}\n\t\tdefer stderr.Close()\n\t\tcmd.Stderr = stderr\n\n\t\t// Generate bootstrap\n\t\tcmdErr = cmd.Run()\n\n\t\t// Command succeeded, exit.\n\t\tif cmdErr == nil {\n\t\t\t// Bootstrap written. Move on without marking as Done as Prestart needs","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/envoy_bootstrap_hook.go#L356-L392","documentation":"Inside the envoy bootstrap retry closure, the hook runs `consul envoy bootstrap` and redirects its stdout into secrets/envoy_bootstrap.json via os.Create. This error wraps a failure of os.Create, i.e. Nomad could not create/truncate the bootstrap output file, so the command was never run.","triggerScenarios":"os.Create(bootstrapFilePath) fails in the retry closure — the secrets directory doesn't exist, the file can't be created due to permissions, or a filesystem/I/O error occurs.","commonSituations":"The alloc dir's secrets/ directory was removed or never created; wrong ownership/permissions on the task dir; read-only or full filesystem; SELinux/AppArmor denying file creation.","solutions":["Verify the alloc dir secrets/ directory exists and is writable by the Nomad client user.","Check host disk space and mount health (dmesg for I/O errors).","Check SELinux/AppArmor logs if file creation is blocked by policy.","Restart the allocation to re-run Prestart and recreate the directory tree."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before running the hook, confirm the target directory is creatable/writable\nif err := os.MkdirAll(filepath.Join(allocDir, \"secrets\"), 0o750); err != nil { return err }\nprobe, err := os.Create(filepath.Join(allocDir, \"secrets\", \".writecheck\"))\nif err != nil { return err }\nprobe.Close()\nos.Remove(probe.Name())","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never delete or chown alloc-dir subdirectories while allocations are running.","Watch for disk-full and read-only-remount alerts on the host.","Audit SELinux/AppArmor policies for the Nomad data path.","Keep the Nomad client user consistent across restarts so file ownership stays valid."],"tags":["go","filesystem","nomad","envoy","file-create"],"backgroundTag":"file-create-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}