hashicorp/terraform · error

failed to create temp known_hosts file: %s

Error message

failed to create temp known_hosts file: %s

What it means

Raised in buildSSHClientConfig when ioutil.TempFile("", "tf-known_hosts") fails while setting up host key verification. When a host_key is configured, the communicator writes it to a temp file because the knownhosts package requires a file path. If the OS cannot create that temp file, host key verification cannot be set up and the error is returned.

Source

Thrown at internal/communicator/ssh/provisioner.go:339

	password    string
	sshAgent    *sshAgent
	certificate string
	user        string
	host        string
	hostKey     string
}

func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) {
	hkCallback := ssh.InsecureIgnoreHostKey()

	if opts.hostKey != "" {
		// The knownhosts package only takes paths to files, but terraform
		// generally wants to handle config data in-memory. Rather than making
		// the known_hosts file an exception, write out the data to a temporary
		// file to create the HostKeyCallback.
		tf, err := ioutil.TempFile("", "tf-known_hosts")
		if err != nil {
			return nil, fmt.Errorf("failed to create temp known_hosts file: %s", err)
		}
		defer tf.Close()
		defer os.RemoveAll(tf.Name())

		// we mark this as a CA as well, but the host key fallback will still
		// use it as a direct match if the remote host doesn't return a
		// certificate.
		if _, err := tf.WriteString(fmt.Sprintf("@cert-authority %s %s\n", opts.host, opts.hostKey)); err != nil {
			return nil, fmt.Errorf("failed to write temp known_hosts file: %s", err)
		}
		tf.Sync()

		hkCallback, err = knownhosts.New(tf.Name())
		if err != nil {
			return nil, err
		}
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Check available disk space and inodes in the temp directory (df -h, df -i).
2. Ensure the process has write permission to TMPDIR.
3. Set TMPDIR to a writable location with adequate space.
4. If host_key verification is not strictly needed, consider removing the host_key attribute (note: this reduces security).

// Validate temp directory writability before setting up host key verification
func validateTempDirForKnownHosts() error {
    tf, err := ioutil.TempFile("", "tf-known_hosts-test")
    if err != nil {
        return fmt.Errorf("cannot create temp file for known_hosts: %w", err)
    }
    tf.Close()
    os.Remove(tf.Name())
    return nil
}

When it happens

Trigger: A connection block with host_key set triggers temp file creation for the known_hosts data. The OS fails to create the file in the system temp directory.

Common situations: The system temp directory is full, out of inodes, read-only, or the process lacks permission. Common in locked-down containers, CI runners under disk pressure, or when TMPDIR is misconfigured.

Related errors

• failed to write temp known_hosts file: %s
• Error creating temporary file for upload: %s
• Upload failed: %v
• Failed to upload script: %v
• Error starting script: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c7e8969aaa7cdd6d. Report an issue: GitHub.