{"record":{"id":"1d6c623be38f2086","repo":"hashicorp/nomad","slug":"failed-to-cleanup-iptables-rules-for-alloc-s","errorCode":null,"errorMessage":"failed to cleanup iptables rules for alloc %s","messagePattern":"failed to cleanup iptables rules for alloc (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_cni.go","lineNumber":693,"sourceCode":"\t\t`-j`,\n\t\tchainID,\n\t}\n\n\t// remove the jump rule\n\tok := true\n\tif err = ipt.Delete(natTable, postRoutingChain, toDel...); err != nil {\n\t\tc.logger.Warn(\"failed to remove iptables nat.POSTROUTING rule\", \"alloc_id\", allocID, \"chain\", chainID, \"error\", err)\n\t\tok = false\n\t}\n\n\t// remote the associated chain\n\tif err = ipt.ClearAndDeleteChain(natTable, chainID); err != nil {\n\t\tc.logger.Warn(\"failed to remove iptables nat chain\", \"chain\", chainID, \"error\", err)\n\t\tok = false\n\t}\n\n\tif !ok {\n\t\treturn fmt.Errorf(\"failed to cleanup iptables rules for alloc %s\", allocID)\n\t}\n\n\treturn nil\n}\n\nfunc (c *cniNetworkConfigurator) ensureCNIInitialized() error {\n\tif err := c.cni.Status(); !cni.IsCNINotInitialized(err) {\n\t\treturn err\n\t}\n\topt, err := c.confParser.getOpt()\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn c.cni.Load(opt)\n}\n\n// nsOpts keeps track of NamespaceOpts usage, mainly for test assertions.\ntype nsOpts struct {","sourceCodeStart":675,"sourceCodeEnd":711,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_cni.go#L675-L711","documentation":"forceCleanup could not delete the alloc's jump rule from nat POSTROUTING and/or clear-and-delete its per-alloc CNI chain; both failures are aggregated into this final error, leaving residual iptables state for the allocation.","triggerScenarios":"Thrown at client/allocrunner/networking_cni.go:693 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run the listed iptables delete commands manually for the alloc's chain","Check for rules referenced by other processes preventing chain deletion","Verify iptables permissions and netfilter kernel module availability"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}