{"record":{"id":"f2c5db55dd62bea2","repo":"hyperledger/fabric","slug":"error-writing-files-to-upload-to-docker-instance-i","errorCode":null,"errorMessage":"error writing files to upload to Docker instance into a temporary tar blob: %s","messagePattern":"error writing files to upload to Docker instance into a temporary tar blob: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/container/dockercontroller/dockercontroller.go","lineNumber":289,"sourceCode":"\n\t// upload TLS files to the container before starting it if needed\n\tif peerConnection.TLSConfig != nil {\n\t\t// the docker upload API takes a tar file, so we need to first\n\t\t// consolidate the file entries to a tar\n\t\tpayload := bytes.NewBuffer(nil)\n\t\tgw := gzip.NewWriter(payload)\n\t\ttw := tar.NewWriter(gw)\n\n\t\t// Note, we goofily base64 encode 2 of the TLS artifacts but not the other for strange historical reasons\n\t\terr = addFiles(tw, map[string][]byte{\n\t\t\tTLSClientKeyPath:      []byte(base64.StdEncoding.EncodeToString(peerConnection.TLSConfig.ClientKey)),\n\t\t\tTLSClientCertPath:     []byte(base64.StdEncoding.EncodeToString(peerConnection.TLSConfig.ClientCert)),\n\t\t\tTLSClientKeyFile:      peerConnection.TLSConfig.ClientKey,\n\t\t\tTLSClientCertFile:     peerConnection.TLSConfig.ClientCert,\n\t\t\tTLSClientRootCertFile: peerConnection.TLSConfig.RootCert,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error writing files to upload to Docker instance into a temporary tar blob: %s\", err)\n\t\t}\n\n\t\t// Write the tar file out\n\t\tif err = tw.Close(); err != nil {\n\t\t\treturn fmt.Errorf(\"error writing files to upload to Docker instance into a temporary tar blob: %s\", err)\n\t\t}\n\n\t\tgw.Close()\n\n\t\t_, err = vm.Client.CopyToContainer(context.Background(), containerName, dcli.CopyToContainerOptions{\n\t\t\tDestinationPath:           \"/\",\n\t\t\tContent:                   bytes.NewReader(payload.Bytes()),\n\t\t\tAllowOverwriteDirWithFile: true,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error uploading files to the container instance %s: %s\", containerName, err)\n\t\t}\n\t}","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/container/dockercontroller/dockercontroller.go#L271-L307","documentation":"Thrown by DockerVM.Start when building the in-memory tar archive of TLS files (addFiles or tar.Writer.Close) fails before it is uploaded to the chaincode container via CopyToContainer. The tar holds the client key/cert (some base64-encoded for historical reasons) and root cert needed for mutual TLS. A failure here means TLS material could not be staged and the container is not started.","triggerScenarios":"Calling Start with a non-nil PeerConnection.TLSConfig while addFiles fails writing one of the five TLS entries (gzip/tar writer errors are rare — typically an internal I/O or state error), or tw.Close() fails flushing the gzip stream.","commonSituations":"Rare in practice; usually seen under memory pressure or when TLSConfig fields are nil/empty causing downstream write problems; also when the gzip/tar writer stack is misused by modified code paths in forks.","solutions":["Check the embedded %s error in the peer log for the underlying tar/gzip failure and fix accordingly.","Verify the TLSConfig fields (ClientKey, ClientCert, RootCert) are fully populated before Start; re-establish the chaincode connection if certs are nil.","Retry Start — tar staging is in-memory and transient resource failures resolve after retry.","If on a fork, review modifications to addFiles/tar writer usage; upstream code assumes valid byte slices for all five entries."],"exampleFix":"// before: partial TLS config\npeerConn.TLSConfig = &ccintf.TLSConfig{ClientCert: cert} // ClientKey missing\n// after\npeerConn.TLSConfig = &ccintf.TLSConfig{ClientKey: key, ClientCert: cert, RootCert: root}","handlingStrategy":"validation","validationCode":"func validateTLSConfig(tls *ccintf.TLSConfig) error {\n\tif tls == nil {\n\t\treturn nil // TLS disabled, tar staging will be skipped\n\t}\n\tif len(tls.ClientKey) == 0 || len(tls.ClientCert) == 0 || len(tls.RootCert) == 0 {\n\t\treturn errors.New(\"TLS config incomplete: key, cert and root cert are required\")\n\t}\n\treturn nil\n}","typeGuard":"func hasCompleteTLS(tls *ccintf.TLSConfig) bool {\n\treturn tls != nil && len(tls.ClientKey) > 0 && len(tls.ClientCert) > 0 && len(tls.RootCert) > 0\n}","tryCatchPattern":"if err := vm.Start(ccid, ccType, peerConn); err != nil {\n\tif strings.Contains(err.Error(), \"temporary tar blob\") {\n\t\t// TLS staging failed — verify TLSConfig fields and retry\n\t}\n\treturn err\n}","preventionTips":["Ensure the full TLS key/cert/root-cert set is populated on PeerConnection before Start.","Validate PEM material at connection setup, not at container start time.","Run Start under sufficient memory; the tar staging is buffered entirely in memory."],"tags":["hyperledger-fabric","tls","tar","docker","go"],"backgroundTag":"tls-artifact-upload-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}