windmill-labs/windmill · error

The provided value for `mode` is too big. Make sure that you

Error message

The provided value for `mode` is too big. Make sure that you are using the octal prefix (0o), e.g. `mode: 0o644`

What it means

The `mode` value in a file resource must be a Unix permission value that fits in 0o0–0o777. This error is thrown when the parsed value exceeds 0o777, almost always because an integer like `644` or `755` was given as a decimal number instead of octal notation — decimal 644 is a valid number but semantically the user meant 0o644.

Source

Thrown at backend/parsers/windmill-parser-yaml/src/lib.rs:821

                        u32::from_str_radix(&s[2..], 2)
                    } else if s.starts_with("0o") {
                        u32::from_str_radix(&s[2..], 8)
                    } else if s.starts_with("0") {
                        u32::from_str_radix(&s[1..], 8)
                    } else {
                        u32::from_str_radix(s, 8)
                    };

                    val.map_err(|e| anyhow!("Error parsing permission mode value {s}: {e}"))?
                }
                _ => {
                    return Err(anyhow!("Invalid field in `mode`, expected integer like 0o644"));
                }
            };
            if mode_val <= 0o777 {
                mode = Some(mode_val);
            } else {
                return Err(anyhow!("The provided value for `mode` is too big. Make sure that you are using the octal prefix (0o), e.g. `mode: 0o644`"));
            }
        }

        if let Some(Yaml::String(resource_path)) = f.get(&Yaml::String("resource".to_string())) {
            return Ok(FileResource {
                resource_path: ResourceOrVariablePath::Resource(resource_path.clone()),
                target_path,
                mode,
            });
        }
        if let Some(Yaml::String(resource_path)) = f.get(&Yaml::String("variable".to_string())) {
            return Ok(FileResource {
                resource_path: ResourceOrVariablePath::Variable(resource_path.clone()),
                target_path,
                mode,
            });
        }
        return Err(anyhow!(

View on GitHub (pinned to e474e8803c)

Solutions

1. Prefix the value with `0o` and quote it: `mode: "0o644"`.
2. Alternatively use the decimal equivalent as an integer: 0o644 = 420, so `mode: 420`.
3. If you need setuid/sticky bits (e.g. 1777), this parser rejects them — keep the mode within 0o777 or set permissions outside Windmill.
4. Verify by converting: `printf '%o' 644` shows what the parser actually saw (decimal 644 = octal 1204, which is why it fails).

Example fix

// before
mode: 644
// after
mode: "0o644"

fn validate_mode_value(raw: &str) -> Result<(), String> {
    let v = if let Some(o) = raw.strip_prefix("0o") { u32::from_str_radix(o, 8) }
        else if let Some(b) = raw.strip_prefix("0b") { u32::from_str_radix(b, 2) }
        else { u32::from_str_radix(raw, 8) };
    match v {
        Ok(m) if m <= 0o777 => Ok(()),
        Ok(m) => Err(format!("mode {m} > 0o777; add the 0o prefix?")),
        Err(e) => Err(e.to_string()),
    }
}

fn fits_unix_mode(n: u32) -> bool { n <= 0o777 }

match deploy(yaml) {
    Err(e) if e.to_string().contains("mode` is too big") => {
        eprintln!("Use octal notation: mode: \"0o644\" (decimal 644 is rejected)\n{e}");
    }
    other => other,
}

When it happens

Trigger: parse_file_resource with `mode: 644` (parsed as decimal 644 > 511) or `mode: 755`, or a string like "0o1777"/"1000" that parses to a value above 0o777. Also `mode: 0b1111111111` (binary > 0o777).

Common situations: Writing `mode: 644` without the `0o` prefix — the single most common mistake; YAML parsers drop leading zeros so `0644` also becomes decimal 644; copying permission modes that include setuid/sticky bits (e.g. 1777) which the parser rejects.

Related errors

• Failed to parse yaml: {}
• Invalid inventory definition
• Vault Password File expects a String containing the file nam
• Vault ID field expects an array of strings in the format: `l
• The elements of the vault_id field should be strings in the

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/f3635c3c71fe2e8f. Report an issue: GitHub.