hashicorp/nomad · error

failed to open source file %q: %w

Error message

failed to open source file %q: %w

What it means

In the unprivileged template-render child process, readTemplate failed to os.Open the template's source file after sandbox path validation, typically because the path escaped the sandbox or the file does not exist; rendering aborts.

Source

Thrown at client/allocrunner/taskrunner/template/renderer/z_template_render.go:89

func readTemplate() error {
	var (
		sandboxPath, sourcePath string
		err                     error
	)

	flags := flag.NewFlagSet("template-render", flag.ExitOnError)
	flags.StringVar(&sandboxPath, "sandbox-path", "", "")
	flags.StringVar(&sourcePath, "source-path", "", "")
	flags.Parse(os.Args[3:])

	sourcePath, err = sandbox(sandboxPath, sourcePath) // platform-specific sandboxing
	if err != nil {
		return fmt.Errorf("failed to sandbox alloc dir %q: %w", sandboxPath, err)
	}

	f, err := os.Open(sourcePath)
	if err != nil {
		return fmt.Errorf("failed to open source file %q: %w", sourcePath, err)
	}
	defer f.Close()

	_, err = io.Copy(os.Stdout, f)
	return err
}

func writeTemplate() (*renderer.RenderResult, error) {

	var (
		sandboxPath, destPath, perms, user, group string
	)

	flags := flag.NewFlagSet("template-render", flag.ExitOnError)
	flags.StringVar(&sandboxPath, "sandbox-path", "", "")
	flags.StringVar(&destPath, "dest-path", "", "")
	flags.StringVar(&perms, "perms", "", "")
	flags.StringVar(&user, "user", "", "")

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the template source path exists in the alloc dir
2. Check the path is not rejected by sandbox validation
3. Check file permissions for the template runner user

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/template/renderer/z_template_render.go:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/7969526c0d20721c. Report an issue: GitHub.