{"record":{"id":"fa720d0190b16125","repo":"quarkusio/quarkus","slug":"failed-to-create-temp-socket-path","errorCode":null,"errorMessage":"Failed to create temp socket path","messagePattern":"Failed to create temp socket path","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/deployment/src/main/java/io/quarkus/spiffe/client/deployment/SpiffeDevServicesProcessor.java","lineNumber":361,"sourceCode":"                errorMessages.add(\"Failed to generate EC P-256 signing key: \" + e.getMessage());\n                throw new RuntimeException(\"Failed to generate EC P-256 signing key\", e);\n            }\n            // trying to keep resources minimal:\n            vertx = Vertx.vertx(new VertxOptions().setWorkerPoolSize(1).setEventLoopPoolSize(1));\n\n            startGrpcServer();\n            startHttpServer();\n        }\n\n        private void startGrpcServer() {\n            if (transport == Transport.UNIX) {\n                Path socketPath;\n                try {\n                    socketPath = Files.createTempFile(Path.of(\"/tmp\"), \"spiffe-\", \".sock\");\n                    Files.delete(socketPath);\n                } catch (IOException e) {\n                    errorMessages.add(\"Failed to create temp socket path: \" + e.getMessage());\n                    throw new RuntimeException(\"Failed to create temp socket path\", e);\n                }\n                grpcAddress = SocketAddress.domainSocketAddress(socketPath.toAbsolutePath().toString());\n            } else {\n                grpcAddress = SocketAddress.inetSocketAddress(0, \"127.0.0.1\");\n            }\n            listenGrpcServer();\n            if (transport != Transport.UNIX) {\n                grpcAddress = SocketAddress.inetSocketAddress(grpcServer.actualPort(), \"127.0.0.1\");\n            }\n            endpointSocket = transport == Transport.UNIX\n                    ? UNIX + grpcAddress.path()\n                    : \"tcp://127.0.0.1:\" + grpcServer.actualPort();\n        }\n\n        private void listenGrpcServer() {\n            grpcServer = vertx.createHttpServer(new HttpServerOptions());\n            try {\n                grpcServer.requestHandler(createGrpcServer())","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/deployment/src/main/java/io/quarkus/spiffe/client/deployment/SpiffeDevServicesProcessor.java#L343-L379","documentation":"When the SPIFFE dev gRPC server uses the unix transport, it needs a unix domain socket file. The processor creates a temp file under /tmp via Files.createTempFile and immediately deletes it to reserve a unique path for the socket. An IOException here aborts startup with RuntimeException 'Failed to create temp socket path'.","triggerScenarios":"startGrpcServer() with Transport.UNIX when /tmp is not writable, does not exist, or Files.createTempFile/Files.delete throws IOException — e.g. read-only root filesystem, sandboxed container, or restrictive permissions on /tmp.","commonSituations":"Running Quarkus dev mode inside a hardened/read-only container or Docker sandbox where /tmp is mounted noexec/ro; CI environments with TMPDIR redirected but /tmp absent; SELinux/AppArmor blocking /tmp writes.","solutions":["Ensure /tmp exists and is writable by the user running the build (check permissions, mount a writable tmpfs in containers).","Use the tcp transport instead (quarkus.spiffe-client.devservices.transport=tcp), which binds an ephemeral 127.0.0.1 port and needs no socket file.","If your platform honors TMPDIR, point it at a writable directory; if not supported, run the dev service outside the sandbox."],"exampleFix":"# before: unix transport in a read-only /tmp environment\nquarkus.spiffe-client.devservices.transport=unix\n\n# after: tcp transport needs no socket file\nquarkus.spiffe-client.devservices.transport=tcp","handlingStrategy":"fallback","validationCode":"Path tmp = Path.of(System.getProperty(\"java.io.tmpdir\"));\nif (!Files.isWritable(tmp)) {\n    throw new IllegalStateException(\"Temp dir not writable; use tcp transport or fix /tmp permissions\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    socketPath = Files.createTempFile(Path.of(\"/tmp\"), \"spiffe-\", \".sock\");\n} catch (IOException e) {\n    LOG.error(\"Cannot create socket file in /tmp; falling back to tcp transport\", e);\n    // switch to SocketAddress.inetSocketAddress(0, \"127.0.0.1\")\n}","preventionTips":["Ensure /tmp is writable in dev containers (mount tmpfs if needed)","Use tcp transport in sandboxed/read-only environments","Verify the user running Quarkus dev mode has write access to the temp directory"],"tags":["quarkus","spiffe","dev-services","unix-socket","filesystem"],"backgroundTag":"permission-denied","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}