microsoft/aspire · error · InvalidOperationException

The path ' ' configured with is outside the Deno…

Error message

The path '{path}' configured with {methodName} is outside the Deno application directory, so it is not part of the generated Dockerfile's build context. Move the file inside the application directory or provide a custom Dockerfile.

What it means

The generated Deno Dockerfile's build context is the Deno application directory. A configured path (config file, etc.) that is absolute or escapes that directory would never be copied into the image, breaking `deno cache` and the entrypoint, so the library throws at build time instead.

Solutions

Move the config/script file inside the Deno application directory and reference it relatively.
Copy the file into the app directory during build/publish before the Dockerfile is generated.
Provide a custom Dockerfile whose build context includes the external file.

Example fix

// before
.WithDenoConfig("../shared/deno.json")
// after
.WithDenoConfig("deno.json") // file copied into the app directory

Defensive patterns

Strategy: validation

Validate before calling

// confirm the path stays inside the app directory before configuring Deno
var full = Path.GetFullPath(Path.Combine(appDirectory, configuredPath));
if (!full.StartsWith(Path.GetFullPath(appDirectory), StringComparison.Ordinal))
{
    throw new ArgumentException($"Path '{configuredPath}' must resolve inside the Deno app directory.");
}

Try / catch

try
{
    app.WithDenoConfig("deno.json");
}
catch (InvalidOperationException ex) when (ex.Message.Contains("outside the Deno application directory"))
{
    // copy the file into the app directory or use a custom Dockerfile
}

Prevention

Keep all Deno config and script files inside the application directory.
Avoid absolute and ../-style paths in WithDeno* calls, especially on CI machines.
Copy shared solution-level configs into each app directory rather than referencing them across directories.

When it happens

Trigger: Calling WithDenoConfig(path) (or another WithDeno* method feeding ThrowIfPathEscapesDenoBuildContext via ThrowIfUnsupportedDenoDenoDockerfileOptions) with an absolute path, a ../-style relative path, or a Windows drive-qualified path outside the app directory.

Common situations: Sharing a single deno.json from a solution-level folder ("../../deno.json"); using an absolute path on CI; referencing a config that lives in a sibling project directory.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/1cb7ae5dc8ac879e. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs:1006

    /// <summary>
    /// Rejects a configured path that would resolve outside the generated Dockerfile's build context.
    /// </summary>
    /// <remarks>
    /// Validation uses the same platform-independent normalizer as the generated Dockerfile. Both <c>/</c> and
    /// <c>\</c> are treated as separators so Windows rooted and UNC paths cannot become absolute only after they
    /// are emitted into the Linux container. Traversal is resolved by depth: <c>config/../deno.json</c> stays
    /// inside the context and normalizes to <c>deno.json</c>, while <c>config/../../outside.json</c> escapes it.
    /// </remarks>
    private static void ThrowIfPathEscapesDenoBuildContext(string? path, string methodName)
    {
        if (string.IsNullOrEmpty(path))
        {
            return;
        }

        if (!TryNormalizeDenoContainerRelativePath(path, out _))
        {
            throw new InvalidOperationException($"The path '{path}' configured with {methodName} is outside the Deno application directory, so it is not part of the generated Dockerfile's build context. Move the file inside the application directory or provide a custom Dockerfile.");
        }
    }

    private static bool TryNormalizeDenoContainerRelativePath(string path, out string normalizedPath)
    {
        var containerPath = path.Replace('\\', '/');
        if (containerPath.StartsWith('/') || IsWindowsDriveQualifiedPath(containerPath))
        {
            normalizedPath = string.Empty;
            return false;
        }

        // Deno accepts remote import maps. They are not build-context paths and must retain the URI's double slash.
        if (Uri.TryCreate(containerPath, UriKind.Absolute, out var uri) &&
            (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps))
        {
            normalizedPath = containerPath;
            return true;

View on GitHub (pinned to 25830f84bd)