ory/hydra · error

newWorker: failed to create stdout pipe

Error message

newWorker: failed to create stdout pipe

What it means

`newWorker` calls `cmd.StdoutPipe()` to receive evaluation results from the jsonnet child; when that returns an error the worker cannot be built and this wrapped error is returned. Like the stdin pipe failure, this is essentially always fd exhaustion (a pipe requires two file descriptors).

Source

Thrown at oryx/jsonnetsecure/jsonnet_pool.go:151

	stdin, err := cmd.StdinPipe()
	if err != nil {
		return worker{}, errors.Wrap(err, "newWorker: failed to create stdin pipe")
	}

	in := make(chan []byte, 1)
	go func(c <-chan []byte) {
		for input := range c {
			if _, err := stdin.Write(append(input, 0)); err != nil {
				stdin.Close()
				return
			}
		}
	}(in)

	stdout, err := cmd.StdoutPipe()
	if err != nil {
		return worker{}, errors.Wrap(err, "newWorker: failed to create stdout pipe")
	}
	stderr, err := cmd.StderrPipe()
	if err != nil {
		return worker{}, errors.Wrap(err, "newWorker: failed to create stderr pipe")
	}

	if err := cmd.Start(); err != nil {
		return worker{}, errors.Wrap(err, "newWorker: failed to start process")
	}

	span.SetAttributes(semconv.ProcessPID(cmd.Process.Pid))

	scan := func(c chan<- string, r io.Reader, maxTokenSize int) {
		defer close(c)
		scanner := bufio.NewScanner(r)
		scanner.Buffer(make([]byte, 0, 64*KiB), maxTokenSize)

		scanner.Split(splitNull)

View on GitHub (pinned to 4174065ffb)

Solutions

1. Raise the fd limit (`ulimit -n`, systemd LimitNOFILE=65536, Docker/K8s `ulimits`/securityContext)
2. Check for pipe/fd leaks with `ls /proc/<pid>/fd | wc -l` and close the pool properly on shutdown
3. Lower the worker pool size to fit the fd budget
4. Audit other subsystems (HTTP clients, DB pools) for unclosed connections competing for fds

var lim syscall.Rlimit
syscall.Getrlimit(syscall.RLIMIT_NOFILE, &lim)
openFDs := countOpenFDs() // e.g. len of /proc/self/fd entries
if openFDs+2 >= int(lim.Cur) {
    return errors.New("fd limit nearly exhausted; cannot create stdout pipe")
}

When it happens

Trigger: During pool warm-up or on-demand worker creation via puddle's Constructor: `cmd.StdoutPipe()` returns an error, typically EMFILE/ENFILE because the parent has exhausted its file descriptors.

Common situations: Running in a container with a low nofile limit while holding many DB connections, sockets, and worker pipes; a leak of pipes from workers that crashed without destroy; spiking the pool size under load.

Related errors

• newWorker: failed to create stdin pipe
• newWorker: failed to create stderr pipe
• failed to write json output
• newWorker: failed to start process
• newWorker: warm up failed

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/d59336f0f5821ac9. Report an issue: GitHub.