What causes "Can not get file info" in goharbor/harbor?

Verify the exact path exists on the Docker host: ls -l

goharbor/harbor · error · Exception

Can not get file info

Error message

Can not get file info

What it means

Thrown by validate() in make/photon/prepare/utils/configs.py during the custom CA bundle check. When harbor.yml sets 'storage_service.ca_bundle', prepare stats the file to later enforce ownership/readability; paths outside /data/ are resolved against the host root as seen inside the prepare container (os.path.join(host_root_dir, path.lstrip('/'))). Any OSError from os.stat (missing file, non-existent directory, permission denied on a parent dir) is logged and re-raised as this generic message.

Source

Thrown at make/photon/prepare/utils/configs.py:70

    # original is registry_storage_provider_config
    storage_provider_config = conf.get("storage_provider_config")
    if storage_provider_name != "filesystem":
        if storage_provider_config == "":
            raise Exception(
                "Error: no provider configurations are provided for provider %s" % storage_provider_name)
    # ca_bundle validate
    if conf.get('registry_custom_ca_bundle_path'):
        registry_custom_ca_bundle_path = conf.get('registry_custom_ca_bundle_path') or ''
        if registry_custom_ca_bundle_path.startswith('/data/'):
            ca_bundle_host_path = registry_custom_ca_bundle_path
        else:
            ca_bundle_host_path = os.path.join(host_root_dir, registry_custom_ca_bundle_path.lstrip('/'))
        try:
            uid = os.stat(ca_bundle_host_path).st_uid
            st_mode = os.stat(ca_bundle_host_path).st_mode
        except Exception as e:
            logging.error(e)
            raise Exception('Can not get file info')
        err_msg = 'Cert File {} should be owned by user with uid 10000 or readable by others'.format(registry_custom_ca_bundle_path)
        if uid == DEFAULT_UID and not owner_can_read(st_mode):
            raise Exception(err_msg)
        if uid != DEFAULT_UID and not other_can_read(st_mode):
            raise Exception(err_msg)

    # TODO:
    # If user enable trust cert dir, need check if the files in this dir is readable.

    if conf.get('trace'):
        conf['trace'].validate()

    if conf.get('purge_upload'):
        conf['purge_upload'].validate()

    if conf.get('cache'):
        conf['cache'].validate()

View on GitHub (pinned to 7b2fd08cc5)

Solutions

Verify the exact path exists on the Docker host: ls -l <path>
Fix the ca_bundle value in harbor.yml to the real absolute path
Ensure every parent directory is traversable (chmod o+x) and the file is inside a location visible to the prepare container
Re-run ./install.sh; the subsequent uid/mode checks (errors 29/30) may then apply

Example fix

# harbor.yml (before)
storage_service:
  ca_bundle: /certs/root-ca.pem   # not present on host

# harbor.yml (after)
storage_service:
  ca_bundle: /data/secret/root-ca.pem  # shipped into the data volume

Defensive patterns

Strategy: try-catch

Validate before calling

import os
p = cfg.get('storage_service', {}).get('ca_bundle')
if p:
    host_path = p if p.startswith('/data/') else os.path.join('/hostfs', p.lstrip('/'))
    if not os.path.isfile(host_path):
        raise SystemExit('ca_bundle not found on host: %s' % host_path)
    if not os.access(host_path, os.R_OK):
        raise SystemExit('ca_bundle not readable: %s' % host_path)

Try / catch

try:
    validate(config_dict)
except Exception as e:
    if 'Can not get file info' in str(e):
        # underlying os.stat error is in the prepare log (logging.error)
        raise SystemExit('ca_bundle path missing/unreadable - check harbor.yml storage_service.ca_bundle')
    raise

Prevention

Copy CA bundles to the Harbor host and reference them by absolute path before install
Check parent-directory permissions, not just the file
Read the prepare log line above the exception - it contains the real os.stat error

When it happens

Trigger: harbor.yml sets ca_bundle to a path that does not exist on the Docker host, or whose parent directories lack execute (search) permission for the prepare container user, or a /data/-prefixed path that is not actually inside the mounted data volume. Example: ca_bundle: /certs/ca.pem with the file actually at /etc/harbor/ca.pem.

Common situations: Private CA bundles for S3 endpoints stored on admin laptops and not copied to the Harbor host; typo'd paths; files under directories with 0700 root-only permissions.

Related errors

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/fc1dcdf39800fd97. Report an issue: GitHub.