quarkusio/quarkus · error · RuntimeException

Failed to create temp socket path

Error message

Failed to create temp socket path

What it means

When the SPIFFE dev gRPC server uses the unix transport, it needs a unix domain socket file. The processor creates a temp file under /tmp via Files.createTempFile and immediately deletes it to reserve a unique path for the socket. An IOException here aborts startup with RuntimeException 'Failed to create temp socket path'.

Source

Thrown at extensions/spiffe-client/deployment/src/main/java/io/quarkus/spiffe/client/deployment/SpiffeDevServicesProcessor.java:361

                errorMessages.add("Failed to generate EC P-256 signing key: " + e.getMessage());
                throw new RuntimeException("Failed to generate EC P-256 signing key", e);
            }
            // trying to keep resources minimal:
            vertx = Vertx.vertx(new VertxOptions().setWorkerPoolSize(1).setEventLoopPoolSize(1));

            startGrpcServer();
            startHttpServer();
        }

        private void startGrpcServer() {
            if (transport == Transport.UNIX) {
                Path socketPath;
                try {
                    socketPath = Files.createTempFile(Path.of("/tmp"), "spiffe-", ".sock");
                    Files.delete(socketPath);
                } catch (IOException e) {
                    errorMessages.add("Failed to create temp socket path: " + e.getMessage());
                    throw new RuntimeException("Failed to create temp socket path", e);
                }
                grpcAddress = SocketAddress.domainSocketAddress(socketPath.toAbsolutePath().toString());
            } else {
                grpcAddress = SocketAddress.inetSocketAddress(0, "127.0.0.1");
            }
            listenGrpcServer();
            if (transport != Transport.UNIX) {
                grpcAddress = SocketAddress.inetSocketAddress(grpcServer.actualPort(), "127.0.0.1");
            }
            endpointSocket = transport == Transport.UNIX
                    ? UNIX + grpcAddress.path()
                    : "tcp://127.0.0.1:" + grpcServer.actualPort();
        }

        private void listenGrpcServer() {
            grpcServer = vertx.createHttpServer(new HttpServerOptions());
            try {
                grpcServer.requestHandler(createGrpcServer())

View on GitHub (pinned to e1c734241f)

Solutions

1. Ensure /tmp exists and is writable by the user running the build (check permissions, mount a writable tmpfs in containers).
2. Use the tcp transport instead (quarkus.spiffe-client.devservices.transport=tcp), which binds an ephemeral 127.0.0.1 port and needs no socket file.
3. If your platform honors TMPDIR, point it at a writable directory; if not supported, run the dev service outside the sandbox.

Example fix

# before: unix transport in a read-only /tmp environment
quarkus.spiffe-client.devservices.transport=unix

# after: tcp transport needs no socket file
quarkus.spiffe-client.devservices.transport=tcp

Path tmp = Path.of(System.getProperty("java.io.tmpdir"));
if (!Files.isWritable(tmp)) {
    throw new IllegalStateException("Temp dir not writable; use tcp transport or fix /tmp permissions");
}

try {
    socketPath = Files.createTempFile(Path.of("/tmp"), "spiffe-", ".sock");
} catch (IOException e) {
    LOG.error("Cannot create socket file in /tmp; falling back to tcp transport", e);
    // switch to SocketAddress.inetSocketAddress(0, "127.0.0.1")
}

When it happens

Trigger: startGrpcServer() with Transport.UNIX when /tmp is not writable, does not exist, or Files.createTempFile/Files.delete throws IOException — e.g. read-only root filesystem, sandboxed container, or restrictive permissions on /tmp.

Common situations: Running Quarkus dev mode inside a hardened/read-only container or Docker sandbox where /tmp is mounted noexec/ro; CI environments with TMPDIR redirected but /tmp absent; SELinux/AppArmor blocking /tmp writes.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• The SPIFFE client extension does not support unix transport
• Failed to generate EC P-256 signing key
• Failed to start SPIFFE gRPC server on ${transport}
• Failed to start SPIFFE HTTP server
• Failed to create output directory for generated sources: %s

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/fa720d0190b16125. Report an issue: GitHub.