testcontainers/testcontainers-java · error · RuntimeException

Failed to create Kibana service account token. Exit code

Error message

Failed to create Kibana service account token. Exit code: {exitCode}, stdout: {stdout}, stderr: {stderr}

What it means

The library creates the Kibana service account token by exec'ing the elasticsearch-service-tokens CLI inside the Elasticsearch container. If the command exits non-zero, this RuntimeException is thrown with the exit code plus captured stdout/stderr to make the underlying failure diagnosable.

Solutions

Read the stderr/stdout in the message — it contains the CLI's actual failure reason; fix that root cause first.
Verify the Elasticsearch image is an official, unmodified image that includes bin/elasticsearch-service-tokens.
Ensure the ES container is fully healthy (not restarting/crashed) when Kibana starts; check its logs.
Confirm the ES version supports service account tokens (7.10+).

Defensive patterns

Strategy: try-catch

Try / catch

try {
    String token = kibana.token();
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Failed to create Kibana service account token")) {
        // message embeds exit code + stdout/stderr; log it and fail fast with context
        throw new AssertionError("Token CLI failed inside ES container: " + e.getMessage(), e);
    }
    throw e;
}

Prevention

Use official, unmodified Elasticsearch images so bin/elasticsearch-service-tokens exists.
Check ES container logs for health issues before Kibana starts.
Use an ES version that supports service account tokens (7.10+).

When it happens

Trigger: Any non-zero exit from the token CLI: wrong ES version lacking the tool, corrupted ES installation, ES container filesystem issues, or the CLI failing to write/read the token file (permissions, disk full).

Common situations: Elasticsearch image misconfigured via custom DockerImageName or startup scripts; ES container unhealthy at the moment token creation runs; custom images (extensions) that strip the service-tokens binary.

Related errors

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/b71b4641c16bcf36. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:573

                String curlCommand = String.format(
                    "curl -sS%s -u \"elastic:$1\" -H 'Content-Type: application/json' -X POST '%s'",
                    curlTlsArgs,
                    endpoint
                );

                Container.ExecResult result = elasticsearch.execInContainer(
                    "/bin/sh",
                    "-c",
                    curlCommand,
                    "sh",
                    elasticPassword
                );

                String stdout = (result.getStdout() == null) ? "" : result.getStdout();
                String stderr = (result.getStderr() == null) ? "" : result.getStderr();

                if (result.getExitCode() != 0) {
                    throw new RuntimeException(
                        "Failed to create Kibana service account token. Exit code: " +
                        result.getExitCode() +
                        ", stdout: " +
                        stdout +
                        ", stderr: " +
                        stderr
                    );
                }

                JsonNode json = OBJECT_MAPPER.readTree(stdout);
                JsonNode value = json.path("token").path("value");
                if (value.isTextual() && !value.asText().trim().isEmpty()) {
                    return value.asText().trim();
                }

                throw new RuntimeException("Service account token response did not contain token.value: " + stdout);
            }
        );

View on GitHub (pinned to 8e549514e3)