Resource leaks: unclosed file handles in workspace_new, file provisioner, login, and local-exec #38575

Terraform Version

Terraform v1.16.0-dev (main branch, HEAD)

Terraform Configuration Files

This is an internal code issue. The resource leaks affect four different code paths, each triggered by normal Terraform operations:

1. terraform workspace new -state=FILE (leaks file handle)
2. file provisioner (leaks temp file handle per invocation)
3. terraform login (leaks HTTP response body on read error)
4. local-exec provisioner (leaks pipe read-end file descriptor per invocation)

# Example triggering leak #2 and #4:
resource "null_resource" "example" {
  provisioner "file" {
    source      = "local-file.txt"
    destination = "/tmp/remote-file.txt"
  }
  provisioner "local-exec" {
    command = "echo hello"
  }
}

Debug Output

No debug output; these are file descriptor leaks visible by code inspection. Long-running Terraform processes (e.g., applying many resources with provisioners) will accumulate leaked file descriptors.

Expected Behavior

All opened file handles, HTTP response bodies, and pipe file descriptors should be properly closed on all code paths, including error paths.

Actual Behavior

Four resource leaks across different packages:

1. internal/command/workspace_new.go: os.Open for reading existing state is never closed
2. internal/builtin/provisioners/file/resource_provisioner.go: ioutil.TempFile handle in getSrc() is never closed; the caller re-opens by path, so the original handle leaks
3. internal/command/login.go: defer resp.Body.Close() is placed after ioutil.ReadAll(resp.Body), meaning the body leaks if ReadAll returns an error (early return)
4. internal/builtin/provisioners/local-exec/resource_provisioner.go: os.Pipe() creates two file descriptors; the write end (pw) is closed, but the read end (pr) is never closed

Steps to Reproduce

1. Review the four files listed above
2. For each, trace the lifecycle of the opened resource (file handle, response body, pipe FD)
3. Note the missing Close() calls on error/completion paths

Additional Context

Each fix is minimal (adding defer f.Close(), moving a defer, adding pr.Close()). I intend to submit a fix for this issue and have a working implementation on my fork.

References

• Previously submitted as Fix resource leaks in provisioners and commands #38541 (closed; resubmitting with issue-first workflow per Contributing.md)
• Fork branch with fix: SebTardif/terraform@fix/resource-leaks

Generative AI / LLM assisted development?

Grok (xAI) was used as an assistant with human-in-the-loop review. All code has been reviewed and understood by the human author.