{"record":{"id":"316c7ece5866f55b","repo":"caddyserver/caddy","slug":"dialing-confirmation-address-v","errorCode":null,"errorMessage":"dialing confirmation address: %v","messagePattern":"dialing confirmation address: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/commandfuncs.go","lineNumber":311,"sourceCode":"\t// log normally, now that the config is running.\n\t// also clear our ref to the buffer so it can get GC'd\n\tlogger = caddy.Log()\n\tdefaultLogger = nil //nolint:ineffassign,wastedassign\n\tlogBuffer = nil     //nolint:wastedassign,ineffassign\n\tlogger.Info(\"serving initial configuration\")\n\n\t// if we are to report to another process the successful start\n\t// of the server, do so now by echoing back contents of stdin\n\tif pingbackFlag != \"\" {\n\t\tconfirmationBytes, err := io.ReadAll(os.Stdin)\n\t\tif err != nil {\n\t\t\treturn caddy.ExitCodeFailedStartup,\n\t\t\t\tfmt.Errorf(\"reading confirmation bytes from stdin: %v\", err)\n\t\t}\n\t\tconn, err := net.Dial(\"tcp\", pingbackFlag)\n\t\tif err != nil {\n\t\t\treturn caddy.ExitCodeFailedStartup,\n\t\t\t\tfmt.Errorf(\"dialing confirmation address: %v\", err)\n\t\t}\n\t\t_, err = conn.Write(confirmationBytes)\n\t\tif err != nil {\n\t\t\treturn caddy.ExitCodeFailedStartup,\n\t\t\t\tfmt.Errorf(\"writing confirmation bytes to %s: %v\", pingbackFlag, err)\n\t\t}\n\t\t// close (non-defer because we `select {}` below)\n\t\t// and release references so they can be GC'd\n\t\tconn.Close()\n\t\tconfirmationBytes = nil //nolint:ineffassign,wastedassign\n\t\tconn = nil              //nolint:wastedassign,ineffassign\n\t}\n\n\t// if enabled, reload config file automatically on changes\n\t// (this better only be used in dev!)\n\tif watchFlag {\n\t\tgo watchConfigFile(configFile, adapterUsed)\n\t}","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/cmd/commandfuncs.go#L293-L329","documentation":"Returned by the `caddy run --pingback` child when net.Dial to the parent's pingback address fails. The parent listens on 127.0.0.1:0 or [::1]:0 and passes the concrete address via --pingback; dial failure means the parent's listener is gone or loopback dialing is blocked. This prevents the child from confirming successful startup.","triggerScenarios":"Parent `caddy start` exited (crash, kill) before the child dialed back; firewall/SELinux blocking loopback connections; container network policy dropping loopback TCP; the address string corrupted by a wrapper.","commonSituations":"Race where the parent is killed immediately after spawn (supervisors, scripts with short timeouts); hardened sandboxes (gVisor, custom seccomp) denying loopback connect.","solutions":["Retry `caddy start` ensuring the parent process stays alive through startup (no aggressive timeouts)","Verify loopback connectivity in the environment: curl http://127.0.0.1:1/ should get a connection refused, not a permission error","Relax sandbox/seccomp rules that block loopback connect()","Use `caddy run` under systemd/supervisor instead of the start/pingback handshake"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-flight in the parent: loopback dial works\nif conn, err := net.DialTimeout(\"tcp\", \"127.0.0.1:1\", time.Second); err == nil {\n    conn.Close()\n} else if strings.Contains(err.Error(), \"permission denied\") {\n    return errors.New(\"loopback dial blocked by policy; fix sandbox rules\")\n}","typeGuard":null,"tryCatchPattern":"// child-side: dial failure with parent gone => exit; parent will observe child exit instead\nif err != nil && strings.Contains(err.Error(), \"dialing confirmation address\") {\n    // parent listener vanished; safe to exit non-zero, do not loop\n}","preventionTips":["Keep the `caddy start` parent alive through the full startup window","Allow loopback connect() in seccomp/SELinux profiles for Caddy","Prefer `caddy run` under a supervisor to skip the handshake entirely"],"tags":["cli","caddy-run","pingback","network","loopback"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}