dagger/dagger · error

failed to read secret file %q: %w

Error message

failed to read secret file %q: %w

What it means

The file secret provider reads the secret from a local file path. After expanding ~ (home dir), os.ReadFile failed, so this error wraps the underlying os error (file not found, permission denied, is a directory, etc.). It indicates the secret file could not be read from disk.

Source

Thrown at engine/client/secretprovider/file.go:22

	"context"
	"fmt"
	"os"

	"github.com/dagger/dagger/engine/client/pathutil"
)

func fileProvider(_ context.Context, path string) ([]byte, error) {
	homeDir, err := os.UserHomeDir()
	if err != nil {
		return nil, err
	}
	path, err = pathutil.ExpandHomeDir(homeDir, path)
	if err != nil {
		return nil, err
	}
	data, err := os.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("failed to read secret file %q: %w", path, err)
	}
	return data, nil
}

View on GitHub (pinned to 82ba2681db)

Solutions

1. Check the file exists at the expanded path: `ls -l <path>`.
2. Fix permissions so the user running Dagger can read it (chmod/chown).
3. Use an absolute path in the file:// URI to avoid working-directory ambiguity.
4. If the path contains ~, confirm HOME is set correctly for the process.

Example fix

// before
uri := "file://secrets/token.txt" // relative, wrong cwd
// after
uri := "file:///home/me/secrets/token.txt" // absolute, readable (chmod 600 owned by user)

# shell: check readability before running Dagger
path="$HOME/secrets/token.txt"
[ -f "$path" ] && [ -r "$path" ] || { echo "secret file missing or unreadable: $path"; exit 1; }

data, err := secret.Plaintext(ctx)
if err != nil {
    var pathErr *fs.PathError
    if errors.As(err, &pathErr) && errors.Is(pathErr.Err, fs.ErrNotExist) {
        return fmt.Errorf("create the secret file first: %w", err)
    }
    return err
}

When it happens

Trigger: A secret reference of the form file://<path> where the path does not exist, is unreadable due to permissions, or is a directory; raised in fileProvider when os.ReadFile returns an error after successful home-dir expansion.

Common situations: Typo in the path; file created by another user with restrictive permissions; path relative to a different working directory than expected; secret file mounted only inside a container but referenced from the host; using ~ in contexts where homeDir resolution differs.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• failed to retrieve %s %q: %w
• failed to run secret command %q: %w
• secret env var not found: %q
• failed to parse secret URL %q: %w
• open %s stream: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/70890975c99f7601. Report an issue: GitHub.