{"record":{"id":"e31f4676f9201cdd","repo":"weaviate/weaviate","slug":"failed-to-create-directories-w-e31f46","errorCode":null,"errorMessage":"failed to create directories: %w","messagePattern":"failed to create directories: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/auth/authorization/rbac/model.go","lineNumber":67,"sourceCode":"\tr = sub, obj, act, ns\n\n\t[policy_definition]\n\tp = sub, obj, act, dom\n\n\t[role_definition]\n\tg = _, _\n\n\t[policy_effect]\n\te = some(where (p.eft == allow))\n\n\t[matchers]\n\tm = g(r.sub, p.sub) && namespaceAwareMatcher(r.obj, p.obj, r.ns) && regexMatch(r.act, p.act)\n`\n)\n\nfunc createStorage(filePath string) error {\n\tif err := os.MkdirAll(filepath.Dir(filePath), os.ModePerm); err != nil {\n\t\treturn fmt.Errorf(\"failed to create directories: %w\", err)\n\t}\n\n\t_, err := os.Stat(filePath)\n\tif err == nil { // file exists\n\t\treturn nil\n\t}\n\n\tif os.IsNotExist(err) {\n\t\tfile, err := os.Create(filePath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create file: %w\", err)\n\t\t}\n\t\tdefer file.Close()\n\t\treturn nil\n\t}\n\n\treturn err\n}","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/auth/authorization/rbac/model.go#L49-L85","documentation":"createStorage in rbac/model.go prepares the directory holding the casbin policy file (os.MkdirAll on filepath.Dir(filePath)). This error wraps a failure to create that directory tree, e.g. <policy-path>/rbac. Init calls it during RBAC initialization when AUTHORIZATION is enabled.","triggerScenarios":"Starting Weaviate with RBAC enabled where os.MkdirAll fails for the parent of policy.csv: parent path doesn't exist and can't be created, path component is a file, or filesystem permission denied.","commonSituations":"PERSISTENCE_DATA_PATH / policy path set to a read-only mount or non-existent volume; path component (e.g. .../rbac) exists as a regular file; container runs as non-root user without write access to the data dir; Kubernetes PVC not mounted.","solutions":["Check the wrapped OS error: 'permission denied' → chown/chmod the policy path for the weaviate process user","Verify the configured policy path is a directory and each component exists as a directory (remove any regular file named 'rbac' at that path)","Ensure the volume/PVC holding the persistence path is mounted and writable in the container","If RBAC is not needed, disable AUTHORIZATION so Init skips storage creation entirely"],"exampleFix":"// before (docker-compose)\ncommand: [\"--host\", \"0.0.0.0\", ...]  # no writable volume for /var/lib/weaviate\n// after\nvolumes:\n  - weaviate_data:/var/lib/weaviate   # writable volume for policy storage","handlingStrategy":"validation","validationCode":"policyDir := filepath.Join(persistencePath, \"rbac\")\nif fi, err := os.Stat(persistencePath); err != nil || !fi.IsDir() {\n    return fmt.Errorf(\"persistence path %s is not an existing directory\", persistencePath)\n}\nif err := syscall.Access(persistencePath, unix.W_OK); err != nil {\n    return fmt.Errorf(\"persistence path %s not writable: %v\", persistencePath, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-create the policy directory with correct ownership in your container image/entrypoint","Mount the persistence path as a writable volume (avoid :ro mounts)","Run Weaviate as a non-root user that owns the data directory","Ensure no regular file occupies a path component of the policy directory"],"tags":["filesystem","rbac","startup","permissions"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}