{"record":{"id":"f5e0750c5364f2df","repo":"fluent/fluentd","slug":"in-debug-agent-unix-path-is-not-writable","errorCode":null,"errorMessage":"in_debug_agent: `#{@unix_path}` is not writable","messagePattern":"in_debug_agent: `#(.+?)` is not writable","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin/in_debug_agent.rb","lineNumber":42,"sourceCode":"      require 'drb/drb'\n      require 'fluent/plugin/file_util'\n      super\n    end\n\n    config_param :bind, :string, default: '127.0.0.1'\n    config_param :port, :integer, default: 24230\n    config_param :unix_path, :string, default: nil\n    #config_param :unix_mode  # TODO\n    config_param :object, :string, default: 'Fluent::Engine'\n\n    def configure(conf)\n      super\n      if system_config.workers > 1\n        @port += fluentd_worker_id\n      end\n      if @unix_path\n        unless ::Fluent::FileUtil.writable?(@unix_path)\n          raise Fluent::ConfigError, \"in_debug_agent: `#{@unix_path}` is not writable\"\n        end\n      end\n    end\n\n    def multi_workers_ready?\n      @unix_path.nil?\n    end\n\n    def start\n      super\n\n      if @unix_path\n        require 'drb/unix'\n        uri = \"drbunix:#{@unix_path}\"\n      else\n        uri = \"druby://#{@bind}:#{@port}\"\n      end\n      log.info \"listening dRuby\", uri: uri, object: @object, worker: fluentd_worker_id","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin/in_debug_agent.rb#L24-L60","documentation":"The debug_agent input opens a DRb Unix socket at unix_path. During configure it checks Fluent::FileUtil.writable?(@unix_path); when that returns false it raises Fluent::ConfigError 'in_debug_agent: `<path>` is not writable'. The check covers a path on a directory without write permission for the fluentd user, a read-only filesystem, or SELinux/AppArmor denials, and fails before the agent starts.","triggerScenarios":"Configuring in_debug_agent with a unix_path whose parent directory the fluentd process cannot write to (commonly /var/run or /run owned by root), or a stale socket path on a read-only mount.","commonSituations":"Running fluentd as a non-root user with unix_path under /var/run; containers with read-only root filesystems; SELinux enforcing on RHEL-type systems; paths copied from root-run examples.","solutions":["Create the parent directory with correct ownership: mkdir -p /var/run/fluent && chown fluent:fluent /var/run/fluent.","Or point unix_path into a writable location such as /tmp/fluent-agent.sock or the fluentd home.","Or omit unix_path entirely to serve debug_agent over TCP on port 24230 (multi_workers_ready? requires unix_path nil).","On SELinux systems, adjust the context or policy for the socket path."],"exampleFix":"# before\n<source>\n  @type debug_agent\n  unix_path /var/run/fluent-agent.sock\n</source>\n# after\nsudo mkdir -p /var/run/fluent && sudo chown fluent:fluent /var/run/fluent\n# config:\n<source>\n  @type debug_agent\n  unix_path /var/run/fluent/fluent-agent.sock\n</source>","handlingStrategy":"validation","validationCode":"# preflight as the fluentd user\nrequire 'fileutils'\npath = '/var/run/fluent/fluent-agent.sock'\ndir = File.dirname(path)\nFileUtils.mkdir_p(dir) unless Dir.exist?(dir)\nabort \"#{dir} not writable\" unless File.writable?(dir)","typeGuard":null,"tryCatchPattern":"begin\n  Fluent::Plugin.new_input('debug_agent').configure(conf)\nrescue Fluent::ConfigError => e\n  abort \"debug_agent config rejected: #{e.message}\" # '... is not writable'\nend","preventionTips":["Place the socket in a directory owned by the fluentd user (systemd RuntimeDirectory=fluent works well).","Prefer TCP mode (omit unix_path) in multi-worker setups.","Check SELinux/AppArmor when fluentd runs confined.","Restrict access: debug_agent exposes internals; do not point it at shared dirs."],"tags":["fluentd","ruby","debug-agent","permissions","unix-socket"],"backgroundTag":"path-not-writable","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}