{"record":{"id":"14309e9bde0184ee","repo":"valyala/fasthttp","slug":"prefork-close-inherited-listener-fd-w","errorCode":null,"errorMessage":"prefork: close inherited listener fd: %w","messagePattern":"prefork: close inherited listener fd: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"prefork/prefork.go","lineNumber":274,"sourceCode":"\tif p.Network == \"\" {\n\t\tp.Network = defaultNetwork\n\t}\n\n\tif p.Reuseport {\n\t\treturn reuseport.Listen(p.Network, addr)\n\t}\n\n\t// fd inheritedListenerFD is the first ExtraFiles entry passed by the\n\t// master process when Reuseport is false. Naming the file gives clearer\n\t// errors from net.FileListener if the fd is invalid.\n\t//\n\t// net.FileListener dups the fd, so we close the wrapping *os.File after\n\t// it returns to avoid leaking the original descriptor. The returned\n\t// listener owns its own dup'd fd and is unaffected by this close.\n\tf := os.NewFile(inheritedListenerFD, \"fasthttp-prefork-listener\")\n\tln, err := net.FileListener(f)\n\tif closeErr := f.Close(); closeErr != nil && err == nil {\n\t\terr = fmt.Errorf(\"prefork: close inherited listener fd: %w\", closeErr)\n\t}\n\tif err != nil {\n\t\tif ln != nil {\n\t\t\t_ = ln.Close()\n\t\t}\n\t\treturn nil, err\n\t}\n\treturn ln, nil\n}\n\n// listenAsChild performs the common child process setup: creates the listener\n// and starts watching the master process if OnMasterDeath is configured.\nfunc (p *Prefork) listenAsChild(addr string) (net.Listener, error) {\n\tln, err := p.listen(addr)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/prefork/prefork.go#L256-L292","documentation":"In fasthttp's prefork child process (listen called from listenAsChild), the inherited listener FD is wrapped via os.NewFile and converted with net.FileListener; the wrapping *os.File is then closed to avoid leaking the original descriptor. If that Close fails, the error is wrapped as 'prefork: close inherited listener fd'. The listener itself owns a dup'd fd and remains usable; this signals an fd bookkeeping problem in the child process.","triggerScenarios":"Running with prefork enabled and the child calling f.Close() on the inherited listener file after net.FileListener — Close fails e.g. due to an invalid fd, fd already closed, or sandbox environments restricting fd operations.","commonSituations":"Containers/sandboxes (gVisor, restricted seccomp) where close(2) on inherited fds misbehaves; running prefork under supervisors that pass unexpected fd state; custom code touching the inherited FD before prefork listens.","solutions":["Update fasthttp — recent versions hardened this path; verify you are on a current release.","Check the environment: run without sandbox/restrictions or adjust seccomp profiles to allow standard fd syscalls.","Ensure nothing else closes or reuses the inherited listener FD before prefork's listen runs.","As a fallback, disable prefork if your deployment doesn't need multi-process socket sharing."],"exampleFix":"// before\n// prefork enabled inside a restricted sandbox\npanic(fasthttp.Prefork(serv, handler))\n// after\nif os.Getenv(\"SANDBOXED\") == \"1\" {\n    // skip prefork in restricted environments\n    panic(fasthttp.Serve(ln, handler))\n}","handlingStrategy":"fallback","validationCode":"// Before enabling prefork in constrained environments, verify fd ops work:\nf := os.NewFile(3, \"probe\")\nif f != nil {\n    if err := f.Close(); err != nil {\n        log.Printf(\"fd close unavailable in this sandbox: %v\", err)\n    }\n}","typeGuard":"func preforkSupported() bool {\n    return runtime.GOOS != \"windows\" && os.Getenv(\"SANDBOXED\") != \"1\"\n}","tryCatchPattern":"// top-level:\nif err := run(); err != nil {\n    if strings.Contains(err.Error(), \"close inherited listener fd\") {\n        log.Printf(\"prefork fd issue, falling back to single process: %v\", err)\n        return serveWithoutPrefork()\n    }\n    return err\n}","preventionTips":["Pin recent fasthttp versions where prefork fd handling is hardened.","Test prefork under your actual sandbox/seccomp profile before deploying.","Never close or dup the inherited listener FD yourself before prefork runs.","Disable prefork where multi-process socket sharing isn't required."],"tags":["fasthttp","prefork","file-descriptor","unix"],"backgroundTag":"prefork-listener-fd-error","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}