ory/hydra · error

failed to run jsonnet within 1s: filename=%s

Error message

failed to run jsonnet within 1s: filename=%s

What it means

EvaluateAnonymousSnippet runs a jsonnet snippet in a separate worker process obtained from a puddle resource pool, with a hard 1-second context timeout. If the worker does not finish evaluating the snippet within 1s, the context deadline fires and this error (attached via WithTimeoutCause) surfaces through the 'jsonnetsecure: eval' wrap. It exists to protect the host from runaway or pathological jsonnet programs that would otherwise hang the caller.

Source

Thrown at oryx/jsonnetsecure/jsonnet_pool.go:269

	ctx, span := tracer.Start(vm.ctx, "jsonnetsecure.processPoolVM.EvaluateAnonymousSnippet", trace.WithAttributes(attribute.String("filename", filename)))
	defer otelx.End(span, &err)

	params := vm.params
	params.Filename = filename
	params.Snippet = snippet
	pp, err := json.Marshal(params)
	if err != nil {
		return "", errors.Wrap(err, "jsonnetsecure: marshal")
	}

	ctx = context.WithValue(ctx, contextValuePath, vm.path)
	ctx = context.WithValue(ctx, contextValueArgs, vm.args)
	worker, err := vm.pool.puddle.Acquire(ctx)
	if err != nil {
		return "", errors.Wrap(err, "jsonnetsecure: acquire")
	}

	ctx, cancel := context.WithTimeoutCause(ctx, 1*time.Second, errors.Errorf("failed to run jsonnet within 1s: filename=%s", filename))
	defer cancel()
	result, err := worker.Value().eval(ctx, pp)
	if err != nil {
		worker.Destroy()
		return "", errors.Wrap(err, "jsonnetsecure: eval")
	} else {
		worker.Release()
	}

	if strings.HasPrefix(result, "ERROR: ") {
		return "", errors.New("jsonnetsecure: " + result)
	}

	return result, nil
}

func NewProcessPoolVM(opts *vmOptions) VM {
	ctx := opts.ctx

View on GitHub (pinned to 4174065ffb)

Solutions

1. Simplify/optimize the jsonnet snippet: reduce recursion, avoid generating very large structures, precompute data outside jsonnet.
2. Reduce concurrent usage of the pool or increase the number of jsonnet worker processes so Acquire does not stall.
3. Raise the 1s timeout in a fork of jsonnetsecure (the timeout is currently hardcoded in jsonnet_pool.go).
4. Catch the error and surface a clear 'jsonnet evaluation timed out' message to the end user instead of retrying immediately.

Example fix

// before
out, err := vm.EvaluateAnonymousSnippet("config.jsonnet", bigSnippet) // times out at 1s
// after
smallSnippet := extractOnlyNeededFields(bigSnippet)
out, err := vm.EvaluateAnonymousSnippet("config.jsonnet", smallSnippet)

// Go: nothing to validate before; keep snippets small
if len(snippet) > 100*1024 {
    return errors.New("jsonnet snippet too large for 1s evaluation budget")
}

if err != nil {
    if strings.Contains(err.Error(), "failed to run jsonnet within 1s") {
        return fmt.Errorf("jsonnet evaluation timed out; simplify the snippet")
    }
    return err
}

When it happens

Trigger: Calling EvaluateAnonymousSnippet (vm.pool.puddle.Acquire path, oryx/jsonnetsecure/jsonnet_pool.go:269) with a snippet whose evaluation — or the wait for a free worker from the pool — takes longer than 1 second. Also fires if the pool is exhausted and Acquire blocks until the deadline.

Common situations: Snippets with large generated data, deep recursion, expensive native functions, or std.parseJson on big payloads. Also occurs under load when all jsonnet worker processes are busy so the 1s budget is consumed while waiting to acquire a worker.

Related errors

• DNS lookup timed out
• ErrNoProcessPool
• ErrProcessPoolClosed
• newWorker: missing binary path in context
• errors.New(err)

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/38f2c421c5b2d58f. Report an issue: GitHub.