What causes "File resource path is invalid: {}" in windmill-labs/windmill?

Use a simple relative target_path without symlinks or special characters in the file resource

File resource path is invalid: {}

Error message

File resource path is invalid: {}

What it means

After writing a file resource, the worker validates the resulting path via define_nsjail_mount because the file must be mounted into the nsjail sandbox. If the validated path cannot be expressed as a safe mount, this error is thrown and file-resource creation fails.

Source

Thrown at backend/windmill-worker/src/ansible_executor.rs:2299

            define_nsjail_mount(job_dir, &validated_path)
                .map_err(|e| anyhow!("Inventory path (a.k.a. `name`) is invalid: {}", e))?,
        );

        logs.push_str(&format!("\nCreated inventory `{}`", inventory.name));
    }

    for file_res in &r.file_resources {
        let r =
            get_resource_or_variable_content(client, &file_res.resource_path, job_id.to_string())
                .await?;
        let path = file_res.target_path.clone();
        let validated_path =
            write_file_at_user_defined_location(job_dir, path.as_str(), &r, file_res.mode)
                .map_err(|e| anyhow!("Couldn't write text file at {}: {}", path, e))?;

        nsjail_mounts.push(
            define_nsjail_mount(job_dir, &validated_path)
                .map_err(|e| anyhow!("File resource path is invalid: {}", e))?,
        );

        logs.push_str(&format!(
            "\nCreated {} from {:?}",
            file_res.target_path, file_res.resource_path
        ));
    }
    append_logs(job_id, w_id, logs, conn).await;

    Ok(nsjail_mounts)
}

async fn get_resource_or_variable_content(
    client: &AuthedClient,
    path: &ResourceOrVariablePath,
    job_id: String,
) -> anyhow::Result<String> {
    Ok(match path {

View on GitHub (pinned to e474e8803c)

Solutions

Use a simple relative target_path without symlinks or special characters in the file resource
Inspect the wrapped error detail to see which nsjail constraint failed
Ensure the worker's nsjail config permits mounting the job_dir subtree (worker setup issue)
File an issue if a previously working path stopped being accepted after a Windmill upgrade

Defensive patterns

Strategy: validation

Validate before calling

if (fileRes.target_path.split('/').some(seg => seg.startsWith('.'))) {
  throw new Error('Avoid dot-segments/symlink-prone names in target_path');
}

Try / catch

try {
  await runJob(job);
} catch (e) {
  if (String(e.message).includes('File resource path is invalid')) {
    // fix target_path or nsjail mount config
  }
  throw e;
}

Prevention

Use plain alphanumeric target paths
Don't create symlinks inside job directories
Keep nsjail mount configuration aligned with worker job_dir layout

When it happens

Trigger: create_file_resources produced a validated_path that define_nsjail_mount rejects — typically a path with symlinks, unusual characters, or one outside the mountable subtree of job_dir.

Common situations: Custom target paths that resolve (via symlink) outside the job directory; worker sandbox configuration changes making previously accepted paths unmountable.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/ff87f76cfbe8c895. Report an issue: GitHub.