What causes "import not available %v" in ory/hydra?

Remove/inline import statements from the Jsonnet source, or pass all data as top-level arguments/ext vars

import not available %v

Error message

import not available %v

What it means

jsonnetsecure.ErrorImporter is an importer that intentionally fails every "import" statement in evaluated Jsonnet code, returning this error with the requested path. It is used to sandbox evaluation so Jsonnet files cannot pull in other files.

Source

Thrown at oryx/jsonnetsecure/jsonnet.go:127

// MakeInProcessVM returns a Jsonnet VM that evaluates in the calling process
// with imports disabled. It provides no isolation: a malicious or buggy snippet
// can exhaust this process's memory and CPU, so it is only safe for trusted
// input. The two legitimate uses are the jsonnet subcommand, which is itself
// the isolation boundary, and offline CLI linting. Everything that evaluates
// tenant-supplied Jsonnet must use MakeSecureVM.
func MakeInProcessVM() *jsonnet.VM {
	vm := jsonnet.MakeVM()
	vm.Importer(new(ErrorImporter))
	return vm
}

// ErrorImporter errors when calling "import".
type ErrorImporter struct{}

// Import fetches data from a map entry.
// All paths are treated as absolute keys.
func (importer *ErrorImporter) Import(importedFrom, importedPath string) (contents jsonnet.Contents, foundAt string, err error) {
	return jsonnet.Contents{}, "", fmt.Errorf("import not available %v", importedPath)
}

func JsonnetTestBinary(t testing.TB) string {
	t.Helper()

	// We can force the usage of a given jsonnet executable.
	// Useful to test different versions, or run the tests under wine.
	if s := os.Getenv("ORY_JSONNET_PATH"); s != "" {
		return s
	}

	var stderr bytes.Buffer
	// Using `t.TempDir()` results in permissions errors on Windows, sometimes.
	outPath := path.Join(os.TempDir(), "jsonnet")
	if runtime.GOOS == "windows" {
		outPath = outPath + ".exe"
	}
	cmd := exec.Command("go", "build", "-o", outPath, "github.com/ory/x/jsonnetsecure/cmd")

View on GitHub (pinned to 4174065ffb)

Solutions

Remove/inline import statements from the Jsonnet source, or pass all data as top-level arguments/ext vars
Supply a real importer (e.g. a FileImporter scoped to an allowed directory) instead of ErrorImporter if imports must work
Pre-resolve imported files and pass their contents to the VM yourself

Example fix

// before
vm.Importer(&jsonnetsecure.ErrorImporter{}) // code does import 'lib.libsonnet'
// after
vm.Importer(&jsonnet.FileImporter{JPaths: []string{"/safe/vendor"}})

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-scan Jsonnet source for imports before secure evaluation
func hasImports(source string) bool {
    return strings.Contains(source, "import ") || strings.Contains(source, "importstr ")
}

Try / catch

out, err := vm.EvaluateAnonymousSnippet("config.jsonnet", source)
if err != nil && strings.Contains(err.Error(), "import not available") {
    return nil, fmt.Errorf("jsonnet config uses imports but secure evaluation forbids them: %w", err)
}

Prevention

Vendor/inline all imported Jsonnet files before secure evaluation
Pass external data via ext vars (vm.ExtCode) instead of imports
Only attach a permissive FileImporter when the directory whitelist is deliberate
Add CI checks that flag import statements in Jsonnet shipped for secure evaluation

When it happens

Trigger: Evaluating Jsonnet source that contains import '...' or importstr '...' while the VM is configured with ErrorImporter (the default secure setup) — any import attempt, even of absolute-looking paths, triggers it.

Common situations: Vendor libraries or templates that use import internally while the host uses jsonnetsecure with imports disabled; running JsonnetTestBinary-based tests on code with imports; migration from plain jsonnet to the secured VM.

Related errors

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/0c4ed8efb5de252e. Report an issue: GitHub.