ory/hydra · error

failed to read from stdin

Error message

failed to read from stdin

What it means

Returned by the jsonnet CLI's RunE when reading the jsonnet snippet (or parameters) from stdin fails. Stdin is the worker's only input channel under the Landlock sandbox; a read error means the pipe was closed early or the harness misused the worker.

Source

Thrown at oryx/jsonnetsecure/cmd.go:55

			// and write JSON to stdout/stderr. Denying all path-based
			// filesystem access prevents a malicious snippet from
			// touching the operator's file system even if the
			// jsonnet VM ever exposed a path-import primitive.
			if err := landlockx.ApplyEmpty(nil); err != nil {
				return errors.Wrap(err, "failed to apply empty landlock sandbox")
			}

			// This could fail because current limits are lower than what we tried to set,
			// so we still continue in this case.
			SetVirtualMemoryLimit(virtualMemoryLimitBytes)

			if null {
				return scan(cmd.OutOrStdout(), cmd.InOrStdin())
			}

			input, err := io.ReadAll(cmd.InOrStdin())
			if err != nil {
				return errors.Wrap(err, "failed to read from stdin")
			}

			json, err := eval(input)
			if err != nil {
				return errors.Wrap(err, "failed to evaluate jsonnet")
			}

			if _, err := io.WriteString(cmd.OutOrStdout(), json); err != nil {
				return errors.Wrap(err, "failed to write json output")
			}
			return nil
		},
	}
	cmd.Flags().BoolVarP(&null, "null", "0", false,
		`Read multiple snippets and parameters from stdin separated by null bytes.
Output will be in the same order as inputs, separated by null bytes.
Evaluation errors will also be reported to stdout, separated by null bytes.
Non-recoverable errors are written to stderr and the program will terminate with a non-zero exit code.`)

View on GitHub (pinned to 4174065ffb)

Solutions

1. Ensure the caller writes the full input and keeps stdin open until EOF
2. Check the wrapped io error for pipe-closed or I/O timeout causes
3. Verify the harness spawns the worker with stdin correctly wired

When it happens

Trigger: Thrown at oryx/jsonnetsecure/cmd.go:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/cc34bb9527e0f244. Report an issue: GitHub.