What causes "failed to read password file %s: %w" in juicedata/juicefs?

Verify the file path exists and is readable: `ls -l ` and `cat ` as the same user running JuiceFS.

failed to read password file %s: %w

Error message

failed to read password file %s: %w

What it means

readPasswordFromFile could not read the password file specified via --password-file. The original OS error (not found, permissions, etc.) is wrapped with the file path. The error propagates out of metadata URL preparation, so the mount/format command aborts.

Source

Thrown at pkg/meta/interface.go:615

	}
	dIndex := strings.Index(uri, "://") + 3
	s := strings.Split(uri[dIndex:atIndex], ":")

	if len(s) > 2 {
		return "", fmt.Errorf("invalid uri: %s", uri)
	}

	if len(s) == 2 && s[1] != "" {
		return uri, nil
	}
	pwd := url.UserPassword("", password) // escape only password
	return uri[:dIndex] + s[0] + pwd.String() + uri[atIndex:], nil
}

func readPasswordFromFile(filePath string) (string, error) {
	content, err := os.ReadFile(filePath)
	if err != nil {
		return "", fmt.Errorf("failed to read password file %s: %w", filePath, err)
	}
	return strings.TrimSpace(string(content)), nil
}

func setPasswordFromEnv(uri string) (string, error) {
	var password string
	var err error

	if metaPassword := os.Getenv("META_PASSWORD"); metaPassword != "" {
		password = metaPassword
	} else if passwordFile := os.Getenv("META_PASSWORD_FILE"); passwordFile != "" {
		password, err = readPasswordFromFile(passwordFile)
		if err != nil {
			return "", err
		}
	} else {
		// No password source available, return original URI
		return uri, nil

View on GitHub (pinned to c9a67b23e8)

Solutions

Verify the file path exists and is readable: `ls -l <path>` and `cat <path>` as the same user running JuiceFS.
Fix permissions (chmod/chown) or run the client as a user with read access.
Update the --password-file argument or the secret mount location (e.g. Kubernetes secret path) to the correct path.

Example fix

// before
--password-file /etc/juicefs/passwd.txt   # file missing
// after
--password-file /etc/juicefs/redis-pass   # verified with ls and cat

Defensive patterns

Strategy: validation

Validate before calling

test -r "$PASS_FILE" || { echo "cannot read password file $PASS_FILE"; exit 1; }

Prevention

Check file existence and readability as the runtime user before launch.
Mount secrets at stable, known paths in containers/systemd units.
Add readiness checks that verify secret files exist at startup.

When it happens

Trigger: Passing `--password-file /path/to/file` where os.ReadFile fails: the file does not exist, the path is wrong, or the process lacks read permission.

Common situations: Typo in the password-file path; file deleted or moved after provisioning; running JuiceFS as a different user (e.g. systemd service or container) that lacks permissions; secret mounted at a different path in a container.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/4886d08af465b1b2. Report an issue: GitHub.