windmill-labs/windmill · error

Inventory path (a.k.a. `name`) is invalid: {}

Error message

Inventory path (a.k.a. `name`) is invalid: {}

What it means

After writing the inventory file, define_nsjail_mount is called to mount it inside the nsjail sandbox; any failure (including the 'Invalid path.' error 1023) is re-wrapped with this message pointing at the inventory's `name`. It means the inventory's name cannot be turned into a valid sandbox mount path.

Source

Thrown at backend/windmill-worker/src/ansible_executor.rs:2282

            }
        }

        let validated_path = write_file_at_user_defined_location(
            job_dir,
            &inventory.name,
            content
                .get("content")
                .and_then(|v| v.as_str())
                .ok_or(anyhow!(
                    "Invalid inventory resource, `content` field absent or invalid"
                ))?,
            None,
        )
        .map_err(|e| anyhow!("Couldn't write inventory: {}", e))?;

        nsjail_mounts.push(
            define_nsjail_mount(job_dir, &validated_path)
                .map_err(|e| anyhow!("Inventory path (a.k.a. `name`) is invalid: {}", e))?,
        );

        logs.push_str(&format!("\nCreated inventory `{}`", inventory.name));
    }

    for file_res in &r.file_resources {
        let r =
            get_resource_or_variable_content(client, &file_res.resource_path, job_id.to_string())
                .await?;
        let path = file_res.target_path.clone();
        let validated_path =
            write_file_at_user_defined_location(job_dir, path.as_str(), &r, file_res.mode)
                .map_err(|e| anyhow!("Couldn't write text file at {}: {}", path, e))?;

        nsjail_mounts.push(
            define_nsjail_mount(job_dir, &validated_path)
                .map_err(|e| anyhow!("File resource path is invalid: {}", e))?,
        );

View on GitHub (pinned to e474e8803c)

Solutions

1. Set inventory `name` to a plain flat filename with no `/`, `..`, or leading path separators.
2. Re-run after renaming; the wrapped inner error tells whether it was path escape or mount config.
3. If the name is already simple, treat it as a worker bug in define_nsjail_mount and check job_dir/validated_path computation.
4. Keep names consistent between the yaml and any callers passing the argument.

Example fix

// before
inventory: { name: "../inventories/prod" }
// after
inventory: { name: "prod" }

if (inventoryName.includes('/') || inventoryName.includes('..') || inventoryName === '') {
  throw new Error('inventory name must be a single relative filename for nsjail mounting');
}

function isNsjailMountableName(s) {
  return typeof s === 'string' && s.length > 0 && !s.includes('/') && !s.includes('..') && s !== '.';
}

When it happens

Trigger: create_file_resources → define_nsjail_mount(job_dir, &validated_path) errors because the path derived from inventory.name escapes job_dir or is not representable (traversal segments, illegal path), then handle_ansible_job wraps it with 'Inventory path (a.k.a. `name`) is invalid: {}'.

Common situations: Inventory name containing `..`, absolute-path prefixes, or nested directory segments the nsjail mount config rejects; a name that strips to an empty relative path.

Related errors

• Invalid path.
• File resource path is invalid: {}
• App ${appPath} not found
• failed to run npm: ${e instanceof Error ? e.message : e} ${
• ${what} must be a non-empty step name without `/` or dot seg

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/01041797c5f78825. Report an issue: GitHub.