hashicorp/nomad · critical

failed to read random bytes: %v

Error message

failed to read random bytes: %v

What it means

Generate creates a random 16-byte UUID using hc-install-style crypto.Bytes; if the cryptographic random source fails it panics with this error, since a UUID cannot be produced without entropy. Being a panic, callers cannot recover via a returned error.

Source

Thrown at helper/uuid/uuid.go:16

// Copyright IBM Corp. 2015, 2026
// SPDX-License-Identifier: MPL-2.0

package uuid

import (
	"fmt"

	"github.com/hashicorp/nomad/helper/crypto"
)

// Generate is used to generate a random UUID.
func Generate() string {
	buf, err := crypto.Bytes(16)
	if err != nil {
		panic(fmt.Errorf("failed to read random bytes: %v", err))
	}

	return fmt.Sprintf("%08x-%04x-%04x-%04x-%12x",
		buf[0:4],
		buf[4:6],
		buf[6:8],
		buf[8:10],
		buf[10:16])
}

// Short is used to generate the first 8 characters of a UUID.
func Short() string {
	return Generate()[0:8]
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Fix the host entropy source (verify /dev/urandom is accessible and seccomp allows getrandom)
2. Restore /dev/urandom device node in the container image
3. Pre-validate crypto entropy availability at startup rather than catching the panic

Example fix

// before
id := uuid.Generate() // panics if crypto.Bytes fails
// after
if _, err := crypto.Bytes(16); err != nil {
	log.Fatalf("no entropy available: %v", err)
}
id := uuid.Generate()

func safeGenerateUUID() (string, error) {
	defer func() {
		if r := recover(); r != nil {
			fmt.Fprintf(os.Stderr, "uuid generate panicked: %v\n", r)
		}
	}()
	// Generate panics on entropy failure; wrap the call site
	return uuid.Generate(), nil
}
// check entropy health periodically: open/read /dev/urandom once at startup

When it happens

Trigger: Calling uuid.Generate() when the OS entropy source is unavailable or fails (e.g. getrandom/read of /dev/urandom errors on a constrained host).

Common situations: Containers with restricted /dev or seccomp blocking getrandom; extremely degraded hosts where urandom returns errors; test environments with stubbed crypto sources.

Related errors

• invalid acl policy: %v
• could not read from random source: %v
• failed to make pkce verifier: %w
• invalid ID %q
• failed to generate root key: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/11cdf6d342220a24. Report an issue: GitHub.