{"record":{"id":"336560c9b1b09bd0","repo":"astrid-runtime/astrid","slug":"failed-to-bind-boot-policy-error","errorCode":null,"errorMessage":"Failed to bind boot policy: {error}","messagePattern":"Failed to bind boot policy: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/astrid-daemon/src/lib.rs","lineNumber":278,"sourceCode":"        runtime_limits,\n        std::collections::HashMap::new(),\n        http_limits,\n        workspace_layout,\n    )\n    .await\n    .map_err(|e| anyhow::anyhow!(\"Failed to boot Kernel: {e}\"))?;\n\n    // Local egress is security policy at durable-root authority, so read it\n    // only after admission and bind it once before any capsule can load.\n    let admitted_config = astrid_config::Config::load_with_home_and_layout(\n        Some(&kernel.workspace_root),\n        astrid_home.root(),\n        kernel.workspace_layout(),\n    )\n    .map_err(|error| anyhow::anyhow!(\"Failed to load admitted-home boot policy: {error:#}\"))?;\n    kernel\n        .bind_boot_local_egress(admitted_config.config.security.capsule_local_egress)\n        .map_err(|error| anyhow::anyhow!(\"Failed to bind boot policy: {error}\"))?;\n\n    if defer_logging {\n        init_logging(&log_config);\n    }\n    kernel\n        .set_system_capsules(\n            unified_cfg\n                .as_ref()\n                .into_iter()\n                .flat_map(|config| config.uplinks.iter())\n                .map(|uplink| uplink.plugin.clone()),\n        )\n        .await;\n\n    // Astrid owns its baseline control plane. Start it before loading optional\n    // distribution capsules so no capsule can race the canonical listener or\n    // make a clean runtime unbootable by being absent or broken.\n    let native_listener = kernel","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-daemon/src/lib.rs#L260-L296","documentation":"Immediately after loading the admitted-home config, the daemon calls `kernel.bind_boot_local_egress(...)` to install the capsule local egress security policy. If binding fails (the kernel rejects the policy), this error wraps the kernel's message. Boot cannot proceed because local egress policy must be bound before any capsule loads.","triggerScenarios":"Daemon `run()` where `security.capsule_local_egress` from the loaded config is invalid or inconsistent with kernel state, causing `bind_boot_local_egress` to return Err.","commonSituations":"Misconfigured egress rules (bad CIDRs, unknown allow/deny entries) in the security section of the config; policy edited after the kernel was booted with a conflicting state.","solutions":["Read the wrapped kernel error to see which egress rule was rejected.","Correct the `security.capsule_local_egress` section of the config (valid CIDRs/entries).","Restart the daemon after fixing the policy so binding happens on a clean boot."],"exampleFix":"// before (config security section)\ncapsule_local_egress = { allow = [\"not-a-cidr\"] }\n// after\ncapsule_local_egress = { allow = [\"127.0.0.0/8\"] }","handlingStrategy":"validation","validationCode":"// shell\n# verify egress rules are syntactically valid CIDRs before boot\nfor cidr in $EGRESS_ALLOW; do\n  python3 -c \"import ipaddress,sys; ipaddress.ip_network(sys.argv[1])\" \"$cidr\" || exit 1\ndone","typeGuard":null,"tryCatchPattern":"// rust\nif let Err(e) = daemon::run(args).await {\n    eprintln!(\"{e:#}\"); // kernel message names the rejected egress rule\n    std::process::exit(1);\n}","preventionTips":["Use CIDR validators when editing security.capsule_local_egress.","Test policy changes in a scratch workspace before production boots.","Restart the daemon cleanly after any policy edit so binding starts fresh."],"tags":["config","security","egress"],"backgroundTag":"invalid-config-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}