apple/pkl · error · IllegalStateException

No security manager set.

Error message

No security manager set.

What it means

SecurityManagers.StandardBuilder.build() refuses to construct a Standard security manager when both allowedModules and allowedResources are empty, because such a manager would deny every access. It throws IllegalStateException with message "No security manager set."

Source

Thrown at pkl-core/src/main/java/org/pkl/core/SecurityManagers.java:342

    public List<Pattern> getAllowedResources() {
      return allowedResources;
    }

    @Override
    public StandardBuilder setRootDir(@Nullable Path rootDir) {
      this.rootDir = rootDir;
      return this;
    }

    @Override
    public @Nullable Path getRootDir() {
      return rootDir;
    }

    @Override
    public SecurityManager build() {
      if (allowedResources.isEmpty() && allowedModules.isEmpty()) {
        throw new IllegalStateException("No security manager set.");
      }

      return new Standard(allowedModules, allowedResources, defaultTrustLevels, rootDir);
    }
  }
}

View on GitHub (pinned to f3efcbfc9b)

Solutions

1. Call allowModule()/allowResource() at least once before build(), or populate allowedModules/allowedResources lists.
2. If no restriction is desired, use SecurityManagers.softAllowAll() / omit installing a security manager instead of building an empty Standard one.
3. Log/validate builder state before build() to fail earlier with a clearer message.

Example fix

// before
SecurityManager sm = new SecurityManagers.StandardBuilder().build(); // throws
// after
SecurityManager sm = new SecurityManagers.StandardBuilder()
    .allowModules(List.of("pkl:base"))
    .allowResources(List.of("file://cfg/**"))
    .build();

if (allowedModules.isEmpty() && allowedResources.isEmpty()) {
  throw new IllegalStateException("Configure at least one allowed module or resource before build()");
}
SecurityManager sm = builder.build();

try {
  sm = builder.build();
} catch (IllegalStateException e) {
  if (e.getMessage().equals("No security manager set.")) {
    sm = builder.allowModule("pkl:base").build();
  } else throw e;
}

When it happens

Trigger: Calling build() on a SecurityManagers.StandardBuilder instance where neither allowModule(...) nor allowResource(...) (or equivalent list mutations) was invoked.

Common situations: Programmatically building a SecurityManager from config where the allow-list keys were absent/misspelled; conditional code paths that skip allow-list population; copy-pasting builder setup and deleting the allowModule calls.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• insufficientModuleTrustLevel
• resourcePastRootDir|modulePastRootDir
• resourceNotInAllowList|moduleNotInAllowList
• invalidUri
• invalidPackageZipChecksum

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/71cfcc6899acdc10. Report an issue: GitHub.