weaviate/weaviate · error

failed to create directories: %w

Error message

failed to create directories: %w

What it means

createStorage in rbac/model.go prepares the directory holding the casbin policy file (os.MkdirAll on filepath.Dir(filePath)). This error wraps a failure to create that directory tree, e.g. <policy-path>/rbac. Init calls it during RBAC initialization when AUTHORIZATION is enabled.

Source

Thrown at usecases/auth/authorization/rbac/model.go:67

	r = sub, obj, act, ns

	[policy_definition]
	p = sub, obj, act, dom

	[role_definition]
	g = _, _

	[policy_effect]
	e = some(where (p.eft == allow))

	[matchers]
	m = g(r.sub, p.sub) && namespaceAwareMatcher(r.obj, p.obj, r.ns) && regexMatch(r.act, p.act)
`
)

func createStorage(filePath string) error {
	if err := os.MkdirAll(filepath.Dir(filePath), os.ModePerm); err != nil {
		return fmt.Errorf("failed to create directories: %w", err)
	}

	_, err := os.Stat(filePath)
	if err == nil { // file exists
		return nil
	}

	if os.IsNotExist(err) {
		file, err := os.Create(filePath)
		if err != nil {
			return fmt.Errorf("failed to create file: %w", err)
		}
		defer file.Close()
		return nil
	}

	return err
}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Check the wrapped OS error: 'permission denied' → chown/chmod the policy path for the weaviate process user
2. Verify the configured policy path is a directory and each component exists as a directory (remove any regular file named 'rbac' at that path)
3. Ensure the volume/PVC holding the persistence path is mounted and writable in the container
4. If RBAC is not needed, disable AUTHORIZATION so Init skips storage creation entirely

Example fix

// before (docker-compose)
command: ["--host", "0.0.0.0", ...]  # no writable volume for /var/lib/weaviate
// after
volumes:
  - weaviate_data:/var/lib/weaviate   # writable volume for policy storage

policyDir := filepath.Join(persistencePath, "rbac")
if fi, err := os.Stat(persistencePath); err != nil || !fi.IsDir() {
    return fmt.Errorf("persistence path %s is not an existing directory", persistencePath)
}
if err := syscall.Access(persistencePath, unix.W_OK); err != nil {
    return fmt.Errorf("persistence path %s not writable: %v", persistencePath, err)
}

When it happens

Trigger: Starting Weaviate with RBAC enabled where os.MkdirAll fails for the parent of policy.csv: parent path doesn't exist and can't be created, path component is a file, or filesystem permission denied.

Common situations: PERSISTENCE_DATA_PATH / policy path set to a read-only mount or non-existent volume; path component (e.g. .../rbac) exists as a regular file; container runs as non-root user without write access to the data dir; Kubernetes PVC not mounted.

Understand the failure class

Background: mkdir permission denied (EACCES): failed to create directory errors explained — this error's family across 32 libraries.

Related errors

• failed to create file: %w
• create storage path: %v
• NAMESPACES_ENABLED=false but cluster has %d namespace-qualif
• delete metadata %s: %w
• failed to mark migration as done: %w

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/e31f4676f9201cdd. Report an issue: GitHub.