{"record":{"id":"32c64cbdd7f64bb5","repo":"cloudflare/cloudflared","slug":"failed-to-get-own-start-time-w","errorCode":null,"errorMessage":"failed to get own start time: %w","messagePattern":"failed to get own start time: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":256,"sourceCode":"\t}\n\n\tif err := json.NewEncoder(f).Encode(content); err != nil {\n\t\treturn lockContent{}, err\n\t}\n\n\treturn content, nil\n}\n\n// newSelfLockContent returns a lockContent describing the current process.\nfunc newSelfLockContent() (lockContent, error) {\n\tpid := int32(os.Getpid()) // nolint: gosec\n\tp, err := process.NewProcess(pid)\n\tif err != nil {\n\t\treturn lockContent{}, fmt.Errorf(\"failed to look up own process: %w\", err)\n\t}\n\tct, err := p.CreateTime()\n\tif err != nil {\n\t\treturn lockContent{}, fmt.Errorf(\"failed to get own start time: %w\", err)\n\t}\n\tid, err := newLockID()\n\tif err != nil {\n\t\treturn lockContent{}, err\n\t}\n\treturn lockContent{PID: pid, StartTime: ct, ID: id}, nil\n}\n\nfunc newLockID() (string, error) {\n\tvar b [16]byte\n\tif _, err := rand.Read(b[:]); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate lock ID: %w\", err)\n\t}\n\treturn hex.EncodeToString(b[:]), nil\n}\n\n// isLockFileStale reads the lock file and checks whether the owning process\n// is dead or has a mismatched start time. Returns (true, content, nil) if","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L238-L274","documentation":"newSelfLockContent wraps p.CreateTime() from go-sysconf/shirou-gopsutil when it fails to read the current process's start time (process creation time). This value is used to fingerprint the lock file so a recycled PID can be detected. The library throws this because a lock file without a reliable start time cannot distinguish a live holder from a recycled PID, so acquiring the lock is aborted instead of writing a misleading file.","triggerScenarios":"Calling createLockFile (via the token/lock acquisition path) when process.NewProcess(os.Getpid()) succeeds but p.CreateTime() fails — e.g. /proc/<pid>/stat unreadable on Linux, restricted /proc mounts in hardened containers, or gopsutil platform failures on unusual OS/kernel combinations.","commonSituations":"Running cloudflared in a container with a masked or read-only /proc, seccomp/AppArmor policies blocking /proc stat reads, degraded procfs on heavily loaded systems, or running on an unsupported/glibc-less platform where gopsutil's CreateTime implementation fails.","solutions":["Inspect the wrapped %w error (e.g. mount /proc with psutil-visible stat files: ensure /proc is mounted with default options inside the container).","Check container security policies (Docker --security-opt seccomp=..., AppArmor/SELinux profiles) that deny stat access to /proc/self and relax them.","Verify the platform is one where gopsutil supports CreateTime (Linux reads /proc/<pid>/stat which is world-readable; macOS/Windows may need same-user).","Update the gopsutil dependency; older versions fail on newer kernels' /proc formats.","As a last resort remove a stale lock file manually once the process holding it is confirmed dead."],"exampleFix":"// before: failing inside a restricted container\ncontent, err := newSelfLockContent()\n// after: verify /proc is usable before acquiring the lock\nif _, err := os.Stat(fmt.Sprintf(\"/proc/%d/stat\", os.Getpid())); err != nil {\n    log.Fatal().Err(err).Msg(\"/proc unavailable; cannot create lock file\")\n}\ncontent, err := newSelfLockContent()","handlingStrategy":"try-catch","validationCode":"if _, err := os.Stat(fmt.Sprintf(\"/proc/%d/stat\", os.Getpid())); err != nil {\n    // /proc stat unavailable; lock acquisition will fail\n}","typeGuard":"func canReadOwnCreateTime() bool {\n    p, err := process.NewProcess(int32(os.Getpid()))\n    return err == nil && func() bool { _, err := p.CreateTime(); return err == nil }()\n}","tryCatchPattern":"content, err := createLockFile(path)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to get own start time\") {\n        // fall back: warn and run without lock, or abort with guidance\n        log.Warn().Err(err).Msg(\"cannot fingerprint process start time; check /proc access\")\n    }\n    return err\n}","preventionTips":["Ensure /proc is mounted normally in containers (no masking of /proc/<pid>/stat).","Audit seccomp/AppArmor/SELinux policies for procfs stat access.","Keep the gopsutil dependency current.","Wrap lock acquisition with a clear diagnostic that surfaces the wrapped cause."],"tags":["go","process","filesystem","lockfile","linux"],"backgroundTag":"file-open-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}