{"record":{"id":"f3ee2420bf0b0a01","repo":"microsoft/aspire","slug":"the-opentelemetry-agent-path-authored-configured-on-resource","errorCode":null,"errorMessage":"The OpenTelemetry agent path '{authored}' configured on resource '{resource.Name}' points outside the application directory, which is the Docker build context, so it cannot be published. Use a path inside '{resource.WorkingDirectory}', or an absolute path that the base image or a mount provides at runtime.","messagePattern":"The OpenTelemetry agent path '(.+?)' configured on resource '(.+?)' points outside the application directory, which is the Docker build context, so it cannot be published\\. Use a path inside '(.+?)', or an absolute path that the base image or a mount provides at runtime\\.","errorType":"exception","errorClass":"DistributedApplicationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Java/JavaDockerfileGenerator.cs","lineNumber":599,"sourceCode":"            return false;\n        }\n\n        // Container paths are POSIX even when the AppHost authored a Windows-style relative path.\n        var normalized = authored.Replace('\\\\', '/');\n\n        // Strip a single leading \"./\" only. Trimming the '.' and '/' characters as a set would turn\n        // \"../agents/otel.jar\" into \"agents/otel.jar\" and emit a COPY for a path that was never in the\n        // build context, failing the container build with a path the author never wrote.\n        if (normalized.StartsWith(\"./\", StringComparison.Ordinal))\n        {\n            normalized = normalized[2..];\n        }\n\n        // The Docker build context is the application directory, so a path that walks above it cannot be\n        // copied forward no matter how it is spelled. Say so instead of silently rewriting it.\n        if (normalized.Split('/').Any(segment => segment == \"..\"))\n        {\n            throw new DistributedApplicationException(\n                $\"The OpenTelemetry agent path '{authored}' configured on resource '{resource.Name}' \" +\n                $\"points outside the application directory, which is the Docker build context, so it cannot be \" +\n                $\"published. Use a path inside '{resource.WorkingDirectory}', or an absolute path that the base \" +\n                $\"image or a mount provides at runtime.\");\n        }\n\n        // The Dockerfile builder emits the shell form of COPY, whose arguments are separated by\n        // whitespace with no quoted form, so \"target/otel agents/javaagent.jar\" would copy two paths that\n        // do not exist. Naming the problem beats failing later inside the container build.\n        if (normalized.Any(char.IsWhiteSpace))\n        {\n            throw new DistributedApplicationException(\n                $\"The OpenTelemetry agent path '{authored}' configured on resource '{resource.Name}' \" +\n                $\"contains whitespace, which a Dockerfile COPY instruction cannot express, so it cannot be \" +\n                $\"published. Move the agent to a path without spaces.\");\n        }\n\n        agentPath = normalized;","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Java/JavaDockerfileGenerator.cs#L581-L617","documentation":"TryGetBuildProducedAgentPath normalizes the OpenTelemetry agent path and rejects any path whose segments include '..'. The Docker build context is the application directory, so a path that walks above it can never be COPYed into the image; the generator throws instead of silently rewriting the path.","triggerScenarios":"Publishing a Java resource whose WithOtelAgent path escapes the app directory, e.g. WithOtelAgent(\"../shared/javaagent.jar\") or \"target/../../agents/javaagent.jar\".","commonSituations":"Keeping the agent jar in a shared folder above the project; restructuring solutions so the agent lives outside the app directory; reusing a path authored for local (host) execution where '..' resolved fine.","solutions":["Move the agent jar inside the application directory (resource.WorkingDirectory) and reference it relatively, e.g. \"otel/javaagent.jar\".","Or use an absolute path that the base image or a runtime mount provides, e.g. \"/opt/otel/javaagent.jar\".","Remove '..' segments from the path."],"exampleFix":"// before\n.WithOtelAgent(\"../shared-libs/javaagent.jar\")\n// after\n.WithOtelAgent(\"otel/javaagent.jar\"); // jar copied into the app directory","handlingStrategy":"validation","validationCode":"var segments = agentPath.Replace('\\\\', '/').Split('/');\nif (segments.Contains(\"..\"))\n    throw new ArgumentException(\"Otel agent path must stay inside the application directory (Docker build context)\");","typeGuard":null,"tryCatchPattern":"try { await PublishAsync(...); } catch (DistributedApplicationException ex) when (ex.Message.Contains(\"outside the application directory\")) { Console.Error.WriteLine(ex.Message); return 1; }","preventionTips":["Place the otel agent jar inside the application directory.","Never use '..' to reach shared folders from published resources.","Use a runtime mount or base-image-provided absolute path if the agent lives outside the build context."],"tags":["java","docker","build-context","opentelemetry"],"backgroundTag":"path-traversal-blocked","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}