What causes "resolve search path %q: %w" in dagger/dagger?

Verify the path exists relative to the search root on the host (ls the synced dir)

resolve search path %q: %w

Error message

resolve search path %q: %w

What it means

After validating the path stays under the root, searchHostPath calls containerdfs.RootPath to resolve symlinks (scoped to the root) so a symlinked operand cannot point outside. This error wraps a failure from RootPath — typically the path does not exist under root or symlink resolution hit the filesystem error of its cause.

Source

Thrown at engine/client/filesync.go:441

		// If absolute, make it relative to the root
		cleaned := p
		if filepath.IsAbs(cleaned) {
			cleaned = strings.TrimPrefix(cleaned, "/")
		}

		// Clean the path (e.g., remove ../, ./, etc.)
		cleaned = filepath.Clean(cleaned)

		// Check if the normalized path would escape the root
		if !filepath.IsLocal(cleaned) {
			return nil, fmt.Errorf("path cannot escape search root: %s", p)
		}

		// Resolve symlinks scoped to root so a symlinked path operand can't
		// point outside the root either.
		resolved, err := containerdfs.RootPath(root, cleaned)
		if err != nil {
			return nil, fmt.Errorf("resolve search path %q: %w", p, err)
		}
		rel, err := filepath.Rel(root, resolved)
		if err != nil {
			return nil, fmt.Errorf("resolve search path %q: %w", p, err)
		}
		opts.Paths[i] = rel
	}

	rgPath, err := exec.LookPath("rg")
	if err == nil {
		return searchWithRipgrep(ctx, root, rgPath, opts)
	}
	return searchWithGrep(ctx, root, opts)
}

// ripgrep JSON output types
type rgJSON struct {
	Type string `json:"type"`

View on GitHub (pinned to 82ba2681db)

Solutions

Verify the path exists relative to the search root on the host (ls the synced dir)
Remove or fix broken/out-of-root symlinks in the searched path
Read the wrapped RootPath cause (not-exist vs symlink loop) and address it specifically

Example fix

// before
Paths: []string{"link-to-missing-target"}
// after
Paths: []string{"actual-dir/file.go"} // or fix the symlink target

Defensive patterns

Strategy: validation

Validate before calling

// verify the path exists under root before searching
abs := filepath.Join(root, rel)
if _, err := os.Lstat(abs); err != nil {
	// path missing or broken symlink
}

Prevention

Check paths exist (os.Lstat) before issuing a host search
Avoid symlinks pointing outside the synced directory, or resolve them yourself first
Keep the synced directory contents and search paths in sync (handle renames/deletes)

When it happens

Trigger: A search path that passes the IsLocal check but does not exist beneath root, is a broken symlink, or crosses a symlink RootPath refuses to follow outside root; called via DiffCopy/searchHostPath.

Common situations: Searching for a file that was deleted or renamed on the host; typos in the path; a symlink whose target is missing or outside the root; stale cached paths after the synced directory changed.

Related errors

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/9bba80d4e5f97204. Report an issue: GitHub.