This error occurs when Terraform detects a symlink with an absolute path target in your configuration or module sources during remote execution. Terraform's unpacking mechanism only allows relative symlinks to prevent security issues and portability problems.
When Terraform packages your configuration for remote execution (especially in Terraform Enterprise or Cloud), it uses a 'slug' mechanism that unpacks files to a destination directory. For security and portability, symlinks within this context must have relative targets (e.g., '../module/path') rather than absolute targets (e.g., '/usr/bin/something'). Absolute symlinks can point outside the configuration directory, creating security vulnerabilities and making the package non-portable across systems.
Run: find . -type l -exec sh -c 'readlink -f "$1" | grep -q "^/" && echo "Absolute: $1"' _ {} \;
This finds all symlinks with absolute targets. Note any paths returned.
Run: rm -rf .terraform
This removes cached modules that may contain absolute symlinks. The next init will rebuild them.
For each absolute symlink found:
1. Note its current target: readlink symlink_name
2. Delete it: rm symlink_name
3. Recreate with relative path: ln -s ../relative/path symlink_name
For example, if a symlink at modules/common/setup.sh points to /usr/local/bin/setup.sh, recreate it as: ln -s /usr/local/bin/setup.sh modules/common/setup.sh (but make the target relative if possible).
If a symlink points to a system path that doesn't have a relative equivalent:
1. Option A - Copy the file instead: cp /path/to/file ./local-copy
2. Option B - Reference the file differently in your code
3. Option C - Use .terraformignore to exclude the symlink:
Create .terraformignore file:
symlink_name
pattern/to/exclude/**Run the check from step 1 again: find . -type l -exec sh -c 'readlink -f "$1" | grep -q "^/" && echo "Absolute: $1"' _ {} \;
The output should now be empty (no absolute symlinks found).
If using Terraform Cloud or Enterprise:
1. Push your changes to your repository
2. Trigger a remote plan: terraform plan (with remote execution configured)
3. Verify it completes without 'unpacking' errors
For Terraform CLI with local execution, test: terraform init && terraform plan
Why this matters: The go-slug library (hashicorp/go-slug) is used internally by Terraform to safely pack and unpack configuration and modules. It restricts symlinks to relative targets to ensure: (1) Security - absolute symlinks could be exploited to read arbitrary files, (2) Portability - absolute paths are system-specific and don't work across different machines or CI environments.
DereferenceSymlinks option: The go-slug library offers DereferenceSymlinks as a PackerOption, which copies symlink targets into the archive instead of storing symlinks. This is a safer alternative if you have external symlinks that must be included.
Module cache considerations: When using terraform get or terraform init, downloaded modules are cached in .terraform/modules. Clearing this directory forces Terraform to re-download and properly handle symlinks. The issue often resolves after removing and reinitializing.
Windows considerations: On Windows systems, creating true symlinks requires administrator privileges or Developer Mode. If symlink creation fails on Windows, ensure you have appropriate permissions or consider using module sources that don't rely on symlinks.
Error: Error installing helm release: cannot re-use a name that is still in use
How to fix "release name in use" error in Terraform with Helm
Error: Error creating GKE Cluster: BadRequest
BadRequest error creating GKE cluster in Terraform
Error: External program failed to produce valid JSON
External program failed to produce valid JSON
Error: Unsupported argument in child module call
How to fix "Unsupported argument in child module call" in Terraform
Error: network is unreachable
How to fix "network is unreachable" in Terraform