{"record":{"id":"496cdbe2c4097b7a","repo":"hashicorp/nomad","slug":"error-switching-to-ns-v-v-496cdb","errorCode":null,"errorMessage":"error switching to ns %v: %v","messagePattern":"error switching to ns (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/lib/nsutil/ns_linux.go","lineNumber":188,"sourceCode":"\t}\n\treturn nil\n}\n\nfunc (ns *netNS) Do(toRun func(NetNS) error) error {\n\tif err := ns.errorIfClosed(); err != nil {\n\t\treturn err\n\t}\n\n\tcontainedCall := func(hostNS NetNS) error {\n\t\tthreadNS, err := GetCurrentNS()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to open current netns: %v\", err)\n\t\t}\n\t\tdefer threadNS.Close()\n\n\t\t// switch to target namespace\n\t\tif err = ns.Set(); err != nil {\n\t\t\treturn fmt.Errorf(\"error switching to ns %v: %v\", ns.file.Name(), err)\n\t\t}\n\t\tdefer func() {\n\t\t\terr := threadNS.Set() // switch back\n\t\t\tif err == nil {\n\t\t\t\t// Unlock the current thread only when we successfully switched back\n\t\t\t\t// to the original namespace; otherwise leave the thread locked which\n\t\t\t\t// will force the runtime to scrap the current thread, that is maybe\n\t\t\t\t// not as optimal but at least always safe to do.\n\t\t\t\truntime.UnlockOSThread()\n\t\t\t}\n\t\t}()\n\n\t\treturn toRun(hostNS)\n\t}\n\n\t// save a handle to current network namespace\n\thostNS, err := GetCurrentNS()\n\tif err != nil {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/lib/nsutil/ns_linux.go#L170-L206","documentation":"This error is returned from netNS.Do() when ns.Set() fails to switch the calling thread into the target network namespace. It wraps the namespace file name and the underlying error (itself typically the unix.Setns failure from netNS.Set).","triggerScenarios":"Calling Do() on a NetNS handle whose setns fails — missing CAP_SYS_ADMIN, target namespace destroyed, closed/invalid fd, or kernel security policy blocking setns(CLONE_NEWNET).","commonSituations":"Network namespace of an exited container; unprivileged execution (no SYS_ADMIN); Docker/Kubernetes security contexts dropping capabilities; seccomp filters disallowing setns.","solutions":["Grant CAP_SYS_ADMIN / run privileged, since setns into a netns requires it","Confirm the owning container/task still lives so the namespace is valid","Check the wrapped error for EPERM (capabilities), EINVAL (bad fd/ns), or EBADF (closed fd)","Ensure the NetNS handle is open and not closed before Do()","Review seccomp/AppArmor profiles for setns allowances"],"exampleFix":"// before\nns, _ := GetNS(\"/var/run/netns/foo\")\nns.Do(func(ns NetNS) error { ... }) // EPERM unprivileged\n// after\nns, err := GetNS(\"/var/run/netns/foo\")\nif err != nil { return err }\nif err := ns.Do(func(ns NetNS) error { ... }); err != nil {\n    return fmt.Errorf(\"run in netns failed (needs CAP_SYS_ADMIN?): %w\", err)\n}","handlingStrategy":"try-catch","validationCode":"func canSwitchTo(ns NetNS) error {\n    if !hasCapSysAdmin() {\n        return errors.New(\"setns into netns requires CAP_SYS_ADMIN\")\n    }\n    return nil\n}","typeGuard":"func netnsAlive(nspath string) bool {\n    err := IsNSorErr(nspath)\n    return err == nil\n}","tryCatchPattern":"err := ns.Do(work)\nif err != nil {\n    if strings.Contains(err.Error(), \"error switching to ns\") {\n        if !hasCapSysAdmin() {\n            return fmt.Errorf(\"run privileged: %w\", err)\n        }\n        return fmt.Errorf(\"target netns may be gone; recreate handle: %w\", err)\n    }\n    return err\n}","preventionTips":["Run with CAP_SYS_ADMIN wherever setns is needed","Refresh the NetNS handle if the target container restarted","Keep seccomp/AppArmor profiles permissive for setns","Check the wrapped errno (EPERM vs EINVAL vs EBADF) to target fixes"],"tags":["linux","network-namespace","namespaces","permissions"],"backgroundTag":"netns-setns-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}