kopia/kopia · error

can't get random bytes for temporary filename

Error message

can't get random bytes for temporary filename

What it means

createTempFileWithData reads random bytes (crypto/rand) to build a unique temporary filename suffix; this error wraps a failure of the system random source. Practically impossible on healthy systems, it indicates the OS entropy source (/dev/urandom, getrandom syscall) is unavailable or returning errors.

Solutions

1. Inspect the wrapped OS error for the random-source failure
2. Fix the OS entropy source (device nodes, seccomp/apparmor rules)
3. Restart the host/container if entropy subsystem is wedged
4. Retry the put once the system random generator works

var b [8]byte
if _, err := crypto_rand.Read(b[:]); err != nil {
    return errors.New("system random source unavailable; cannot perform writes")
}

err := st.PutBlob(ctx, blobID, data, blob.PutOptions{})
if err != nil && strings.Contains(err.Error(), "random bytes") {
    // entropy problem is host-level: back off and retry, alert ops
    time.Sleep(time.Second)
    return retryPut()
}

When it happens

Trigger: crypto/rand.Read failing while generating tempFileRandomSuffixLen bytes for a temp filename during PutBlobInPath/PutBlob.

Common situations: Severely degraded or misconfigured containers/OS where getrandom blocks or fails; restricted /dev/urandom in unusual chroot/jail setups.

Related errors

• can't create tmp file
• can't remove tmp file
• can't write to temp file
• cannot create temp file
• cannot create temporary file

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/60c0da9ba7a5a98c. Report an issue: GitHub.

Appendix: source

Thrown at repo/blob/filesystem/filesystem_storage.go:220

				return errors.Wrapf(err, "can't get mod time for file %q", path)
			}

			*t = fi.ModTime()
		}

		return nil
	}), fs.isRetriable)

	return err
}

// createTempFileWithData creates a temporary file, writes data to it, syncs and closes it.
// Returns the name of the temporary file and an error.
// If there is an error writing, syncing, or closing the file, the temporary file is removed.
func (fs *fsImpl) createTempFileWithData(path string, data blob.Bytes) (name string, err error) {
	randSuffix := make([]byte, tempFileRandomSuffixLen)
	if _, err := rand.Read(randSuffix); err != nil {
		return "", errors.Wrap(err, "can't get random bytes for temporary filename")
	}

	tempFile := fmt.Sprintf("%s.tmp.%x", path, randSuffix)

	f, err := fs.createTempFileAndDir(tempFile)
	if err != nil {
		return "", errors.Wrap(err, "cannot create temporary file")
	}

	defer func() {
		if closeErr := f.Close(); closeErr != nil {
			err = stderrors.Join(err, errors.Wrap(closeErr, "can't close temporary file"))
		}

		// remove temp file when any of the operations fail
		if err != nil {
			name = ""

View on GitHub (pinned to 82495e54b5)