dagger/dagger · error

failed to evaluate symlinks for %s: %w

Error message

failed to evaluate symlinks for %s: %w

What it means

debianLike.initialize resolves the CA bundle path /etc/ssl/certs/ca-certificates.crt through ContainerFS.EvaluateSymlinks before configuring commonInstaller. ErrNotExist and EINVAL (not a symlink) are tolerated, but any other error while resolving symlinks is fatal and wrapped with this message.

Source

Thrown at engine/engineutil/cacerts/distros.go:54

the same pattern for CA certs though. It's named debianLike
for lack of a better name :-)
*/
type debianLike struct {
	*commonInstaller
}

func (d *debianLike) initialize(ctrFS *containerfs.ContainerFS) error {
	bundlePath := "/etc/ssl/certs/ca-certificates.crt"
	resolvedBundlePath, err := ctrFS.EvaluateSymlinks(bundlePath)
	switch {
	case err == nil:
		bundlePath = resolvedBundlePath
	case errors.Is(err, os.ErrNotExist):
		// didn't exist, ignore
	case errors.Is(err, unix.EINVAL):
		// not a symlink, ignore
	default:
		return fmt.Errorf("failed to evaluate symlinks for %s: %w", bundlePath, err)
	}

	d.commonInstaller = &commonInstaller{
		ctrFS:           ctrFS,
		bundlePath:      bundlePath,
		customCACertDir: "/usr/local/share/ca-certificates",
		updateCmd:       []string{"update-ca-certificates"},
	}

	return nil
}

func (d *debianLike) detect() (bool, error) {
	if exists, err := d.ctrFS.AnyPathExists([]string{
		"/etc/debian_version",
		"/etc/alpine-release",
		"/etc/gentoo-release",
	}); err != nil {

View on GitHub (pinned to 82ba2681db)

Solutions

1. Inspect the wrapped cause (%w) — fix the underlying filesystem error (permissions, ELOOP, I/O)
2. Verify /etc/ssl/certs is readable inside the container image
3. Rebuild or pull a fresh copy of the base image if its /etc/ssl is corrupted
4. Check that no custom mounts/SDK manipulations are making the bundle path unresolvable

Example fix

// before: broken symlink loop in image
RUN ln -s ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
// after: real file or valid symlink
RUN ln -sf /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # ensure target exists

if _, err := os.Lstat("/etc/ssl/certs"); err != nil {
    return fmt.Errorf("container /etc/ssl/certs unusable: %w", err)
}
// on wrapped "failed to evaluate symlinks": inspect errors.Is(err, unix.ELOOP), fs.ErrPermission

When it happens

Trigger: ctrFS.EvaluateSymlinks("/etc/ssl/certs/ca-certificates.crt") returns an error other than os.ErrNotExist or unix.EINVAL during CA cert installation in a debian/alpine/wolfi/gentoo container.

Common situations: Permission errors walking /etc/ssl/certs in a rootless or restricted container; corrupted or looping symlinks (ELOOP); I/O errors on an unhealthy overlay snapshot; unusual images where the path is a directory or otherwise odd.

Related errors

• failed to remove materialized bundle: %w
• failed to restore symlink %s -> %s: %w
• failed to readlink %s: %w
• failed to read symlink target %s for %s: %w
• failed to remove symlink %s: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/5dd861026718fbf3. Report an issue: GitHub.