{"record":{"id":"20fba0b584b80e59","repo":"hashicorp/nomad","slug":"failed-to-list-iptables-rules-w","errorCode":null,"errorMessage":"failed to list iptables rules: %w","messagePattern":"failed to list iptables rules: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_cni.go","lineNumber":641,"sourceCode":"\t//   -A POSTROUTING -s 172.26.64.191/32 -m comment --comment \"name: \\\"nomad\\\" id: \\\"6b235529-8111-4bbe-520b-d639b1d2a94e\\\"\" -j CNI-50e58ea77dc52e0c731e3799\n\tipRuleRe = regexp.MustCompile(`-A POSTROUTING -s (\\S+) -m comment --comment \"name: \\\\\"nomad\\\\\" id: \\\\\"([[:xdigit:]-]+)\\\\\"\" -j (CNI-[[:xdigit:]]+)`)\n)\n\n// forceCleanup is the backup plan for removing the iptables rule and chain associated with\n// an allocation that was using bridge networking. The cni library refuses to handle a\n// dirty state - e.g. the pause container is removed out of band, and so we must cleanup\n// iptables ourselves to avoid leaking rules.\nfunc (c *cniNetworkConfigurator) forceCleanup(ipt IPTablesCleanup, allocID string) error {\n\tconst (\n\t\tnatTable         = \"nat\"\n\t\tpostRoutingChain = \"POSTROUTING\"\n\t\tcommentFmt       = `--comment \"name: \\\"nomad\\\" id: \\\"%s\\\"\"`\n\t)\n\n\t// list the rules on the POSTROUTING chain of the nat table\n\trules, err := ipt.List(natTable, postRoutingChain)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to list iptables rules: %w\", err)\n\t}\n\n\t// find the POSTROUTING rule associated with our allocation\n\tmatcher := fmt.Sprintf(commentFmt, allocID)\n\tvar ruleToPurge string\n\tfor _, rule := range rules {\n\t\tif strings.Contains(rule, matcher) {\n\t\t\truleToPurge = rule\n\t\t\tbreak\n\t\t}\n\t}\n\n\t// no rule found for our allocation, just give up\n\tif ruleToPurge == \"\" {\n\t\tc.logger.Info(\"iptables cleanup: did not find postrouting rule for alloc\", \"alloc_id\", allocID)\n\t\treturn nil\n\t}\n","sourceCodeStart":623,"sourceCodeEnd":659,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_cni.go#L623-L659","documentation":"Returned by forceCleanup when enumerating existing iptables rules fails during bridge-network cleanup. Without the rule listing the stale per-allocation NAT rule and chain cannot be located for removal.","triggerScenarios":"Thrown at client/allocrunner/networking_cni.go:641 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify iptables is installed and the nomad user can run it","Check for kernel/netfilter module errors in dmesg","Clean rules manually: iptables -t nat -S | grep CNI"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}