remotion-dev/remotion · error · error

could not generate random hash: %w

Error message

could not generate random hash: %w

What it means

Returned by randomHash when crypto/rand.Reader fails to produce a secure random integer. The hash is used as the 10-character suffix of a new S3 bucket name. The crypto/rand source essentially never fails on a healthy Linux/macOS system, so this error almost always indicates the kernel's entropy pool is unavailable (very early boot) or that the OS random device is broken.

Source

Thrown at packages/lambda-go/s3.go:44

type objectUploader interface {
	PutObject(context.Context, *s3.PutObjectInput, ...func(*s3.Options)) (*s3.PutObjectOutput, error)
}

// hashPayload returns the SHA256 hex digest used as the input-props object name.
func hashPayload(payload string) string {
	sum := sha256.Sum256([]byte(payload))
	return hex.EncodeToString(sum[:])
}

// randomHash returns a 10 character [a-z0-9] string used as a bucket suffix.
func randomHash() (string, error) {
	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
	b := make([]byte, 10)
	for i := range b {
		index, err := rand.Int(rand.Reader, big.NewInt(int64(len(alphabet))))
		if err != nil {
			return "", fmt.Errorf("could not generate random hash: %w", err)
		}
		b[i] = alphabet[index.Int64()]
	}
	return string(b), nil
}

// makeBucketName mirrors the JS SDK bucket naming convention.
func makeBucketName(region string) (string, error) {
	suffix, err := randomHash()
	if err != nil {
		return "", err
	}
	return bucketNamePrefix + strings.ReplaceAll(region, "-", "") + "-" + suffix, nil
}

func inputPropsKey(hash string) string {
	return fmt.Sprintf("input-props/%s.json", hash)
}

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. Retry the operation once the host is past early boot; the CRNG initializes quickly.
2. Ensure /dev/urandom is mounted and readable inside the container (`ls -l /dev/urandom`).
3. If it persists, report a host/VM issue to your infrastructure team — this is not an application bug.

var name string
// crypto/rand failures are transient on a cold host; one retry is reasonable.
for attempt := 0; attempt < 2; attempt++ {
    n, err := randomHash()
    if err == nil { name = n; break }
    if attempt == 1 { return err }
}

When it happens

Trigger: rand.Int returns an error because /dev/urandom cannot be read, or the kernel CSPRNG is in a not-yet-initialized state during early boot on a VM/container without getrandom() support.

Common situations: Running the Go binary during container startup before the host's CRNG is initialized. Stripped-down containers that do not mount /dev/urandom. Extremely rare on modern kernels.

Related errors

• could not load AWS config: %w
• could not get location of S3 bucket %q: %w
• could not list S3 buckets: %w
• you have multiple buckets (%s) in your S3 region (%s) starti
• failed to create bucket: %w

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/ed2e9bf9a96891d4. Report an issue: GitHub.