dagger/dagger · error

knownHosts is required unless insecureSkipHostKeyCheck is tr

Error message

knownHosts is required unless insecureSkipHostKeyCheck is true

What it means

Input validation error in sshfsVolume: creating an SSHFS-backed volume requires either an explicit knownHosts secret (SSH host key pins) or the explicit opt-out insecureSkipHostKeyCheck=true. Dagger refuses to silently skip host key verification.

Source

Thrown at core/schema/volume.go:96

type sshfsVolumeArgs struct {
	Endpoint                 string
	PrivateKey               core.SecretID
	KnownHosts               dagql.Optional[core.SecretID]
	CacheKey                 dagql.Optional[dagql.String]
	InsecureSkipHostKeyCheck bool `default:"false"`
	ExperimentalServiceHost  dagql.Optional[core.ServiceID]
}

func (s *volumeSchema) sshfsVolume(ctx context.Context, parent dagql.ObjectResult[*core.Query], args sshfsVolumeArgs) (dagql.ObjectResult[*core.Volume], error) {
	if err := parent.Self().RequireMainClient(ctx); err != nil {
		return dagql.ObjectResult[*core.Volume]{}, err
	}
	endpoint, hostKeyAlias, err := parseSSHFSVolumeEndpoint(args.Endpoint)
	if err != nil {
		return dagql.ObjectResult[*core.Volume]{}, err
	}
	if !args.KnownHosts.Valid && !args.InsecureSkipHostKeyCheck {
		return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("knownHosts is required unless insecureSkipHostKeyCheck is true")
	}

	srv, err := core.CurrentDagqlServer(ctx)
	if err != nil {
		return dagql.ObjectResult[*core.Volume]{}, err
	}
	privateKey, err := args.PrivateKey.Load(ctx, srv)
	if err != nil {
		return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("load volume private key: %w", err)
	}
	var knownHosts dagql.ObjectResult[*core.Secret]
	if args.KnownHosts.Valid {
		knownHosts, err = args.KnownHosts.Value.Load(ctx, srv)
		if err != nil {
			return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("load volume known hosts: %w", err)
		}
	}
	var serviceHost dagql.ObjectResult[*core.Service]

View on GitHub (pinned to 82ba2681db)

Solutions

1. Pass a knownHosts secret containing the server's SSH host keys
2. Set insecureSkipHostKeyCheck: true to explicitly skip verification (dev only)
3. Generate the known hosts entry via `ssh-keyscan <host>` and register it as a secret
4. Verify the argument name/spelling in the SDK you are using

Example fix

// before
query.sshfsVolume({ endpoint: "user@host:/path", privateKey: key })
// after
const knownHosts = await client.setSecret("kh", knownHostsText)
query.sshfsVolume({ endpoint: "user@host:/path", privateKey: key, knownHosts })

if (!knownHostsSecret && !insecureSkipHostKeyCheck) { throw new Error('provide knownHosts or set insecureSkipHostKeyCheck=true before calling sshfsVolume') }

try { client.sshfsVolume(args) } catch (e) { if (String(e).includes('knownHosts is required')) { /* fix args and retry */ } throw e }

When it happens

Trigger: Calling Query.sshfsVolume (experimental) with no knownHosts secret and insecureSkipHostKeyCheck left at its default false.

Common situations: Quick experiment scripts omitting host key material; migrations from plain SSH mounts; SDK code copied without the knownHosts argument.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• volume address missing privateKey query parameter
• load volume private key: %w
• path cannot escape directory: %s
• load volume privateKey secret: %w
• parse insecureSkipHostKeyCheck: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/3f52e3bcf91136b5. Report an issue: GitHub.