x/tools/imports: always print 'failed to create modcache index dir'

[tosone]

Go version

go1.25.1

Output of go env in your module/workspace:

AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/Users/xxx/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/xxx/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/5t/blhg1z3175b4spmsbsfj7nz00000gn/T/go-build3480933261=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/Users/xxx/code/epscp/upload-server-new/go.mod'
GOMODCACHE='/Users/xxx/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/xxx/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/Users/xxx/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.0.darwin-arm64'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/xxx/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/Users/xxx/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.0.darwin-arm64/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.24.0'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

package main

import (
	"fmt"
	"runtime"

	_ "golang.org/x/tools/imports"
)

func main() {
	fmt.Println(runtime.Version())
	fmt.Println("Hello, World!")
}

What did you see happen?

Always print 2025/09/17 22:04:12 failed to create modcache index dir: mkdir /home/bytedance: permission denied before my app startup.

What did you expect to see?

print nothing.

I suspect this commit introduced the issue. @adonovan

My application depends on gorm.io/gen, which in turn relies on golang.org/x/tools/imports.

[gabyhelp]

Related Issues

• x/tools/go/gcexportdata: can't import package from pkg/mod #52269
• cmd/go: repeated, unhelpful errors when module cache can't be created #45113 (closed)
• import/path: issue title #69545 (closed)
• affected/package: golang.org/x/tools #55912 (closed)
• cmd/go: randomly broken 'go tool' invocations #73179 (closed)
• go: writing stat cache:, permission denied #26814 (closed)
• tools/go/packages: must go.sum exist? #29635 (closed)
• affected/package: go install not working #52294 (closed)
• Cannot determine module path for source directory #29974 (closed)
• x/tools/imports: does not find imports from go.mod #27865 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[mknyszek]

CC @golang/tools-team

[adonovan]

This suggests that your os.UserCacheDir is not writable. Could you fmt.Println(os.UserCacheDir()) and inspect it? Most likely it is $HOME/Library/Caches, which should be owned by you with mode 0700.

[tosone]

package main

import (
	"fmt"
	"os"
	"runtime"

	_ "golang.org/x/tools/imports"
)

func main() {
	fmt.Println(runtime.Version())
	fmt.Println(os.UserCacheDir())
	fmt.Println("Hello, World!")
}

// output:

// 2025/09/18 10:46:28 failed to create modcache index dir: mkdir /home/bytedance: permission denied
// go1.24.0
// /home/bytedance/.cache <nil>
// Hello, World!

My dockerfile like this:

FROM debian:bookworm-20250811-slim

WORKDIR /app

RUN adduser --no-create-home --uid 1001 bytedance

USER bytedance

COPY bin/hello-server /app/hello-server

ENTRYPOINT ["/app/hello-server"]

[tosone]

This commit appears to require the modcache directory to exist, but I don't see how my application uses this directory.

[adonovan]

Well, if your home directory isn't writable, it definitely isn't going to work. Many programs (not just those in Go) expect that they can create files in $HOME or $XDG_CACHE_HOME for caches, configuration files, etc. The Go function os.UserCacheDir returns the user's preferred cache directory. If you don't want gopls to use $HOME, then set XDG_CACHE_HOME to some other directory in your Dockerfile.

I think gopls is working as intended here.

[zekth]

What about read-only file systems? Several infrastructures rely on this paradigm, meaning that the binary would be mounted and not be able to write within the environment it's deployed at.

Well, if your home directory isn't writable, it definitely isn't going to work

We're currently deployed in a non writable env and our applications work properly. This can be seen as a regression of the runtime.

[adonovan]

It looks like the intent of the import code (even before https://go.dev/cl/682717) was to fall back to TMPDIR in the case that the cache dir couldn't be written, but the actual logic falls back to TMPDIR only when we failed even to locate the cache directory:

var IndexDir string = func() string {
	var dir string
	if testing.Testing() {
		dir = os.TempDir()
	} else {
		var err error
		dir, err = os.UserCacheDir()
		// shouldn't happen, but TempDir is better than
		// creating ./go/imports
		if err != nil {
			dir = os.TempDir()
		}
	}
	dir = filepath.Join(dir, "goimports")
	if err := os.MkdirAll(dir, 0777); err != nil {
		log.Printf("failed to create modcache index dir: %v", err)
	}
	return dir
}()

I think we should attempt to write something to the cache directory as well, and fall back if that fails. It could be an empty file with a fixed name. (cc @pjweinb)