errno

A phone input mask that silently rewrote the number I typed

Sat, 05 Sep 2026 00:00:00 +0000

Numbers in this post are placeholders; the original test used a real number that has been redacted.

What happened

A registration form had a mobile number field with a national format mask:

<input type="text" class="form-control mask-phone" name="phone"
 maxlength="14" minlength="14" required placeholder="Mobile number">

I filled it with a foreign number in international form. The field did not go red, no message appeared — the value became:

input: +421900123456
field: 06

Typing digit by digit was worse. The mask pre-seeds the national trunk prefix, so my leading digits were consumed as part of it and the rest shifted:

Cloudflare Email Routing rejects mail with 550 5.7.26 "not authenticated"

Sat, 05 Sep 2026 00:00:00 +0000

Symptom

A freshly created routing rule (contact@example.com → a Gmail mailbox) looked configured. Sending a test message straight to the MX from a host with no outbound mail authentication failed at the DATA stage:

smtplib.SMTPDataError: (550, b'5.7.26 Cannot forward emails that are not authenticated.
Refer to https://developers.cloudflare.com/email-routing/postmaster/ for more information..')

Note where it failed: MAIL FROM and RCPT TO were both accepted, so it is not an unknown-recipient or configuration problem.

HTTP 522 after pointing a domain at Cloudflare Pages (and the Search Console fallout)

Sat, 05 Sep 2026 00:00:00 +0000

What I did, and what broke

Migrating a static site to Cloudflare Pages, in this order:

POST /accounts/{id}/pages/projects — create project
wrangler pages deploy public --project-name … — upload, deployment succeeded
POST /accounts/{id}/pages/projects/{p}/domains — add site.example.com
immediately repoint the DNS record to <project>.pages.dev, proxied

Seconds later:

$ curl -sSI https://site.example.com/
HTTP/2 522
server: cloudflare
cf-ray: a3664d60bfb3386b-LHR

The domain was serving Cloudflare’s “connection timed out” error, because the Pages side had not finished attaching it:

reCAPTCHA v3 rejects your headless Chromium and no fingerprint patch fixes it

Sat, 05 Sep 2026 00:00:00 +0000

Symptom

An end-to-end check drives a form on a site I am allowed to automate. In a normal browser session the submission succeeds. From headless Chromium, the token is generated without error — grecaptcha.execute() resolves and returns a 2 361-character token — but the backend rejects it:

{"success":false,"errors":{"general":["validation.recaptchav3"]}}

The important detail: the failure is not client-side. There is no exception, no missing site key, no network error. The token exists and is syntactically fine. reCAPTCHA v3 is score-based, and the score arrives at the server too low to pass its threshold.

MCP server dies at startup after the mcp package resolves to 2.0.0

Fri, 04 Sep 2026 00:00:00 +0000

Symptom

Two stdio MCP servers that had worked for weeks stopped appearing in the client. No tools, no error dialog — the server process simply exits during startup, and the client shows it as failed to connect. Running it by hand shows why:

AttributeError: 'Server' object has no attribute 'list_tools'

Nothing in the project changed. That is the tell.

Cause: an unpinned SDK and a fresh resolution

The server’s dependency spec was permissive:

mcp>=0.9.0

uv re-resolves on each run when there is no lock file in play, and the newest release satisfying that range became 2.0.0, which removed the decorator-style Server.list_tools() API the server was written against. The code is fine; it is simply talking to a different major version than the one it was built for.

gpsoauth returns BadAuthentication on a 2FA Google account (app passwords do not help)

Thu, 03 Sep 2026 00:00:00 +0000

Symptom

Getting a master token for a library that speaks Google’s mobile auth protocol (in my case gkeepapi for Google Keep) starts with gpsoauth. On an account with 2FA enabled it fails:

>>> import gpsoauth
>>> gpsoauth.perform_master_login("me@gmail.com", "…", android_id)
{'Error': 'BadAuthentication', 'ErrorDetail': ''}

The reflex is to generate an app password and retry. It fails the same way. App passwords work for IMAP/SMTP, not for this endpoint, so no amount of retrying the password path will produce a token.

Graylog 7 API: POST /api/streams returns 400 "entity cannot be null"

Wed, 26 Aug 2026 00:00:00 +0000

Symptom

A stream-creation call that worked against Graylog 6 now fails:

$ curl -sS -u "$USER:$PASS" -H 'X-Requested-By: cli' -H 'Content-Type: application/json' \
 -d '{"title":"nginx","description":"nginx access logs","remove_matches_from_default_stream":false}' \
 https://graylog.example.com/api/streams

HTTP/1.1 400 Bad Request
{"type":"ApiError","message":"entity cannot be null"}

Nothing in the message points at the payload shape, so the natural assumption — a missing required field such as index_set_id — sends you down the wrong path.

Cause

In Graylog 7 the endpoint takes a CreateEntityRequest: the stream itself moved one level down, under an entity key. Send the same fields wrapped:

Synology NAS: scp fails with "subsystem request failed on channel 0"

Sat, 22 Aug 2026 00:00:00 +0000

Symptom

SSH into the NAS works. Copying a file off it does not:

$ ssh nasuser@nas.example.lan 'echo login ok'
login ok

$ scp nasuser@nas.example.lan:/volume1/media/clip.mp4 .
subsystem request failed on channel 0
scp: Connection closed

sftp fails the same way:

$ sftp nasuser@nas.example.lan
Connection closed.
subsystem request failed on channel 0

Diagnosis

Modern scp no longer uses the legacy remote-copy protocol; it speaks SFTP, which requires the server to offer an sftp subsystem. On this DSM installation, that subsystem is not exposed, so the channel request is rejected before any transfer starts. The interactive shell is unaffected, which is exactly why the failure looks so confusing: authentication, host key and network are all fine.

docker manifest inspect fails with "permission denied" on /etc/docker/certs.d

Wed, 12 Aug 2026 00:00:00 +0000

Symptom

A deployment script verifies that the requested tag exists before it touches a running stack. Under the deploy user it fails:

$ docker manifest inspect registry.example.com/backend:1.42
error: open /etc/docker/certs.d/registry.example.com/ca.crt: permission denied

Under root on the same node the identical command returns the manifest. Pulling images works for the deploy user too, which makes the failure look arbitrary.

Why root works and your user does not

docker manifest inspect is one of the CLI commands that talks to the registry from the client process, not through the daemon. So it needs to read the registry CA itself — and /etc/docker/certs.d/... is intentionally readable only by root and the daemon.

Editing a Subversion repository without a working copy: svnmucc

Wed, 12 Aug 2026 00:00:00 +0000

The problem with a checkout

Release repositories tend to be large and deeply nested. Changing one deploy script means a checkout of a tree you do not care about, a build-up of stale working copies on a jump host, and a real risk of committing something you did not intend because the working copy had other local modifications.

For scripted or one-off edits, skip the working copy entirely.

svnmucc: multiple URL commands, one commit

svnmucc \
 put local/stack-deploy-or-update.sh \
 svn://svn.example.com/svn/release/trunk/projects/app/test/docker/stack-deploy-or-update.sh \
 rm svn://svn.example.com/svn/release/trunk/projects/app/test/docker/portainer-compose.yml \
 -m "APP: unify deploy script, drop portainer compose" \
 --username builder --non-interactive --no-auth-cache

Everything on that command line lands as one atomic revision — which is the property you want when a change spans several files and half of it applied would leave the environment broken. The available operations are put, rm, mkdir, cp, mv and propset, all addressed by URL.

WSL2: /mnt/c fails with "Input/output error (os error 5)" after the laptop sleeps

Wed, 12 Aug 2026 00:00:00 +0000

Symptom

The laptop was suspended with a WSL2 session open. After resume, every path under /mnt is dead:

$ ls /mnt/c
ls: reading directory '/mnt/c': Input/output error

$ cat /mnt/d/some/file
cat: /mnt/d/some/file: Input/output error

Python, Node and anything else that touches those paths reports the same thing as os error 5:

OSError: [Errno 5] Input/output error: '/mnt/c'

Native Linux filesystems are unaffected. /, /home, /mnt/wsl and /mnt/wslg behave normally, and long-running processes that never touch /mnt keep going.

Teams incoming webhook returns HTTP 200 but no message appears

Tue, 11 Aug 2026 00:00:00 +0000

Symptom

A monitoring or automation job posts to a Teams incoming webhook. The client is happy:

$ curl -sS -i -H 'Content-Type: application/json' \
 -d '{"text":"certificate renewed"}' \
 'https://example.webhook.office.com/webhookb2/…'
HTTP/1.1 200 OK

acme.sh reports send success. Nothing arrives in the channel. No error, no bounce, no entry anywhere.

The proof is in the response headers

Look past the status line:

x-nanoproxy: 1
x-proxyerrorhresult: 0x80070036
x-proxyerrormessage: The network is busy.

That is not a transient condition despite what it says. Microsoft retired Office 365 connectors, and the endpoints now answer 200 at a proxy while discarding the payload. Any client that only checks the status code will report success forever, which is why this failure survives in cron jobs and alerting scripts for months.

Reading and writing MediaWiki pages from a script: action=raw and the two-token login

Wed, 05 Aug 2026 00:00:00 +0000

Reading: skip the HTML, ask for raw wikitext

Fetching an article URL with a normal client and parsing the HTML is where most scripts start, and it goes wrong in a way that is easy to miss: a plain GET of the page URL can land you on Recent Changes instead of the article — a redirect that a browser resolves invisibly but that leaves your parser looking at completely different content and “working”.

Word tracked changes in a .docx: python-docx cannot do it, raw XML can

Tue, 28 Jul 2026 00:00:00 +0000

The constraint

A release-management document had to come back with native Word tracked changes — the reviewer wanted to accept or reject each edit in Word, not read a changelog. The obvious tool does not do it:

python-docx exposes runs, paragraphs and styles, but no API for revisions. There is no run.insert_tracked(), and writing the text through python-docx produces a document where your edits are indistinguishable from the original. If tracked changes are a requirement, you are editing OOXML directly.

When an MCP wrapper hides API fields: set Redmine parent, due date and estimate over REST

Wed, 17 Jun 2026 00:00:00 +0000

Symptom

An agent-facing MCP wrapper for Redmine exposes issue creation and updates, but only a subset of the fields:

subject, description, assigned_to_id, status_id, priority_id, done_ratio

So a task can be created — but it cannot be attached to a parent, given a deadline, or given an estimate. There is no error to debug; the parameters simply do not exist in the tool schema, which is a worse failure mode, because the model happily reports success on a partially created issue.

About

Mon, 01 Jan 0001 00:00:00 +0000

I am Attila Csontos. I work on infrastructure: Linux, Docker Swarm, monitoring, on-premise deployments and the long tail of tooling that surrounds them.

This site exists because of a specific frustration. When a system throws Input/output error (os error 5) or subsystem request failed on channel 0, a search usually returns three kinds of pages: someone with the same problem and no answer, a generic tutorial that never mentions the error, or a page that lists five “solutions” that the author clearly never ran.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

Email: contact [at] jofrey [dot] eu

Useful things to send:

A correction. If a fix here does not work on your version, send the version and the exact output. Corrections are published with a dated note.
A missing detail. If a post skips a step that was obvious to me and not to you, that is a bug in the post.
Privacy or legal requests. See Privacy and Terms.

I answer in English, Slovak and Hungarian. I do not accept guest posts, link exchanges or sponsored articles — the site would lose the only thing that makes it worth reading.

Privacy policy

Mon, 01 Jan 0001 00:00:00 +0000

Last updated: 5 September 2026

This site is a static website. There is no user account, no login, no comment form and no newsletter. I collect no personal data directly.

Hosting

The site is served by Cloudflare Pages (Cloudflare, Inc.). Cloudflare processes technical connection data — including your IP address, user agent and requested URL — to deliver the pages and to protect the service against abuse. See Cloudflare’s own privacy documentation for details and retention periods.

Terms of use

Mon, 01 Jan 0001 00:00:00 +0000

Last updated: 5 September 2026

No warranty

Everything here describes what happened on my systems, with the versions stated in each post. Commands touch filesystems, containers, network configuration and production services. Read them before running them, and adapt them to your environment. You run them at your own risk; I accept no liability for data loss, downtime or any other damage.

Accuracy and versions

Software changes. A fix that is correct for Graylog 7.x or Hugo 0.165 may be wrong two releases later. Each post states the version it was verified against. Where I could not verify a claim, it is marked as unverified in the text.