dagger/dagger · error

load volume known hosts: %w

Error message

load volume known hosts: %w

What it means

Raised in sshfsVolume when the optional knownHosts secret cannot be loaded from the dagql server (args.KnownHosts.Value.Load fails). Same mechanism as the private-key load error but for the SSH known-hosts pins secret.

Source

Thrown at core/schema/volume.go:111

		return dagql.ObjectResult[*core.Volume]{}, err
	}
	if !args.KnownHosts.Valid && !args.InsecureSkipHostKeyCheck {
		return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("knownHosts is required unless insecureSkipHostKeyCheck is true")
	}

	srv, err := core.CurrentDagqlServer(ctx)
	if err != nil {
		return dagql.ObjectResult[*core.Volume]{}, err
	}
	privateKey, err := args.PrivateKey.Load(ctx, srv)
	if err != nil {
		return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("load volume private key: %w", err)
	}
	var knownHosts dagql.ObjectResult[*core.Secret]
	if args.KnownHosts.Valid {
		knownHosts, err = args.KnownHosts.Value.Load(ctx, srv)
		if err != nil {
			return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("load volume known hosts: %w", err)
		}
	}
	var serviceHost dagql.ObjectResult[*core.Service]
	if args.ExperimentalServiceHost.Valid {
		serviceHost, err = args.ExperimentalServiceHost.Value.Load(ctx, srv)
		if err != nil {
			return dagql.ObjectResult[*core.Volume]{}, fmt.Errorf("load volume service host: %w", err)
		}
	}

	vol := &core.Volume{
		Backend: core.VolumeBackendKindSSHFS,
		SSHFS: &core.SSHFSVolumeConfig{
			Endpoint:                 endpoint,
			PrivateKey:               privateKey,
			KnownHosts:               knownHosts,
			InsecureSkipHostKeyCheck: args.InsecureSkipHostKeyCheck,
			HostKeyAlias:             hostKeyAlias,

View on GitHub (pinned to 82ba2681db)

Solutions

1. Re-set the knownHosts secret in the current session and pass the new ID
2. Confirm the SecretID originates from the same engine/session
3. Check the wrapped error for not-found vs permission causes
4. Guard creation order: setSecret before sshfsVolume

Example fix

// before
sshfsVolume({ ..., knownHosts: cachedKnownHostsID }) // stale across sessions
// after
kh := client.setSecret("known-hosts", sshKeyscanOutput)
sshfsVolume({ ..., knownHosts: kh })

if (knownHostsId) { /* ensure it was produced by client.setSecret in this session */ }

try { client.sshfsVolume({ knownHosts }) } catch (e) { if (String(e).includes('load volume known hosts')) { knownHosts = await client.setSecret('known-hosts', khText) /* retry */ } throw e }

When it happens

Trigger: Calling Query.sshfsVolume with a valid-flagged knownHosts whose SecretID fails to resolve: ID from another session, deleted secret, or server fetch error.

Common situations: knownHosts secret created in a previous Dagger session; CI caching secret IDs across runs; mismatched engine instances.

Related errors

• load volume privateKey secret: %w
• load volume knownHosts secret: %w
• load volume private key: %w
• volume address missing privateKey query parameter
• parse insecureSkipHostKeyCheck: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/c6b7bc42834bff9c. Report an issue: GitHub.