ory/hydra · error

jsonnetsecure: eval

Error message

jsonnetsecure: eval

What it means

This is the errors.Wrap wrapper ('jsonnetsecure: eval') around any error returned by worker.Value().eval(ctx, pp) in EvaluateAnonymousSnippet. It can wrap the 1s deadline cause (error 180), a worker process crash/kill, or an eval transport failure. On this path the worker is destroyed (not returned to the pool) because it is presumed unhealthy.

Source

Thrown at oryx/jsonnetsecure/jsonnet_pool.go:274

	params.Snippet = snippet
	pp, err := json.Marshal(params)
	if err != nil {
		return "", errors.Wrap(err, "jsonnetsecure: marshal")
	}

	ctx = context.WithValue(ctx, contextValuePath, vm.path)
	ctx = context.WithValue(ctx, contextValueArgs, vm.args)
	worker, err := vm.pool.puddle.Acquire(ctx)
	if err != nil {
		return "", errors.Wrap(err, "jsonnetsecure: acquire")
	}

	ctx, cancel := context.WithTimeoutCause(ctx, 1*time.Second, errors.Errorf("failed to run jsonnet within 1s: filename=%s", filename))
	defer cancel()
	result, err := worker.Value().eval(ctx, pp)
	if err != nil {
		worker.Destroy()
		return "", errors.Wrap(err, "jsonnetsecure: eval")
	} else {
		worker.Release()
	}

	if strings.HasPrefix(result, "ERROR: ") {
		return "", errors.New("jsonnetsecure: " + result)
	}

	return result, nil
}

func NewProcessPoolVM(opts *vmOptions) VM {
	ctx := opts.ctx
	if ctx == nil {
		ctx = context.Background()
	}
	return &processPoolVM{
		path: opts.jsonnetBinaryPath,

View on GitHub (pinned to 4174065ffb)

Solutions

1. Unwrap the error (errors.Unwrap / %v of cause) to find the root cause — most often the 1s deadline.
2. Optimize the jsonnet snippet (less recursion, smaller data) so eval completes quickly.
3. Ensure jsonnet worker processes are not being killed (check memory limits, OOM killer logs).
4. Retry with backoff only if the cause is transient (e.g., busy pool), not for deterministic snippet errors.

if err != nil {
    var cause error
    for e := err; e != nil; e = errors.Unwrap(e) {
        cause = e
    }
    log.Printf("jsonnet eval failed, root cause: %v", cause)
    return err
}

When it happens

Trigger: Any failure from worker.Value().eval during EvaluateAnonymousSnippet (oryx/jsonnetsecure/jsonnet_pool.go:274): context deadline exceeded (1s timeout), worker process died mid-eval, or the eval round-trip failed.

Common situations: Same as the timeout error: heavy snippets, worker process OOM-killed by the OS, or pool contention. The wrap message alone indicates the underlying cause is in the wrapped error chain.

Related errors

• ErrNoProcessPool
• ErrProcessPoolClosed
• newWorker: missing binary path in context
• errors.New(err)
• jsonnetsecure: " + result

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/338e1487a7356b88. Report an issue: GitHub.