dagger/dagger · error

failed to read existing bundle: %w

Error message

failed to read existing bundle: %w

What it means

During commonInstaller.Install in engine/engineutil/cacerts/distros.go:349, the code wraps any error from d.ctrFS.ReadCABundleFile(d.bundlePath). This read only happens when the CA bundle file already existed in the container filesystem; the library parses it to know which certs are already bundled so it can restore the original bundle on uninstall. The wrapped cause is whatever the filesystem layer returned (permission denied, not a regular file, I/O error, etc.).

Source

Thrown at engine/engineutil/cacerts/distros.go:349

	if err != nil {
		return err
	}

	_, lookupErr := d.ctrFS.LookPath(d.updateCmd[0])
	d.updateCommandExisted = lookupErr == nil
	if !d.updateCommandExisted && !errors.Is(lookupErr, exec.ErrNotFound) {
		return fmt.Errorf("failed to lookup %s: %w", d.updateCmd[0], lookupErr)
	}

	d.installedCerts, d.installedSymlinks, err = containerfs.ReadHostCustomCADir(EngineCustomCACertsDir)
	if err != nil {
		return fmt.Errorf("failed to read custom CA dir: %w", err)
	}

	if d.bundleExisted {
		d.existingBundledCerts, err = d.ctrFS.ReadCABundleFile(d.bundlePath)
		if err != nil {
			return fmt.Errorf("failed to read existing bundle: %w", err)
		}
		d.originalBundleMtime, err = d.ctrFS.MtimeOf(d.bundlePath)
		if err != nil {
			return fmt.Errorf("failed to get mtime of bundle: %w", err)
		}
	}

	if d.customCACertDirExisted {
		d.existingCerts, d.existingSymlinks, err = d.ctrFS.ReadCustomCADir(d.customCACertDir)
		if err != nil {
			return fmt.Errorf("failed to read existing custom CA dir: %w", err)
		}
	} else {
		d.createdCACertDirParent, err = d.ctrFS.MkdirAll(d.customCACertDir, 0755)
		if err != nil {
			return err
		}
		cleanups.append(func() error {

View on GitHub (pinned to 82ba2681db)

Solutions

1. Check that the file at bundlePath is a readable regular PEM bundle (e.g. exec `ls -l` / `cat` the path inside the container).
2. Recreate or restore the default CA bundle (e.g. reinstall the ca-certificates package) so the file is valid.
3. Retry Install; a transient FS error may clear.
4. If the bundle path is customized, point it at the distro's real bundle location.

Example fix

// before (broken symlink at /etc/ssl/certs/ca-certificates.crt)
ln -s /nonexistent /etc/ssl/certs/ca-certificates.crt
// after
ln -sf /etc/ca-certificates/extracted/tls-ca-bundle.pem /etc/ssl/certs/ca-certificates.crt

// before Install, inside the container
if [ ! -f /etc/ssl/certs/ca-certificates.crt ] || ! head -c1 /etc/ssl/certs/ca-certificates.crt >/dev/null 2>&1; then echo 'bundle unreadable'; fi

func isFileReadable(path string) bool {
	st, err := os.Stat(path)
	return err == nil && st.Mode().IsRegular()
}

err := installer.Install(ctx)
if err != nil && strings.Contains(err.Error(), "failed to read existing bundle") {
	var perr *fs.PathError
	if errors.As(err, &perr) { /* inspect perr.Err: permission vs not-exist */ }
}

When it happens

Trigger: Install() is called on a distro installer whose bundlePath already exists (bundleExisted==true) but ReadCABundleFile cannot read/parse it: file became unreadable between PathExists and the read, the path is a broken symlink or special file, or the container FS returned an I/O/permission error.

Common situations: The bundle path points to a directory or dangling symlink; read-only or corrupted container filesystem; another process truncated/replaced the bundle mid-install; SELinux/AppArmor-style permission restrictions inside the container.

Related errors

• failed to remove materialized bundle %s: %w
• failed to check if bundle exists: %w
• failed to lookup %s: %w
• failed to read custom CA dir: %w
• failed to get mtime of bundle: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/1618fc9dfe3ad73d. Report an issue: GitHub.