{"record":{"id":"4aa800285298467c","repo":"cilium/cilium","slug":"unable-get-time-w","errorCode":null,"errorMessage":"Unable get time: %w","messagePattern":"Unable get time: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bpf/bpf_linux.go","lineNumber":135,"sourceCode":"\t\t}\n\n\t\treturn createMap(spec, &opts)\n\t}\n\n\treturn m, err\n}\n\n// GetMtime returns monotonic time that can be used to compare\n// values with ktime_get_ns() BPF helper, e.g. needed to check\n// the timeout in sec for BPF entries. We return the raw nsec,\n// although that is not quite usable for comparison. Go has\n// runtime.nanotime() but doesn't expose it as API.\nfunc GetMtime() (uint64, error) {\n\tvar ts unix.Timespec\n\n\terr := unix.ClockGettime(unix.CLOCK_MONOTONIC, &ts)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"Unable get time: %w\", err)\n\t}\n\n\treturn uint64(unix.TimespecToNsec(ts)), nil\n}\n","sourceCodeStart":117,"sourceCodeEnd":140,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/bpf/bpf_linux.go#L117-L140","documentation":"GetMtime returns a high-resolution monotonic timestamp via clock_gettime(CLOCK_MONOTONIC). This error is wrapped when the ClockGettime syscall fails. On Linux this essentially never fails in normal operation, so seeing it indicates a severely restricted environment (seccomp filter, broken vDSO/syscall allowlist) or an exotic platform.","triggerScenarios":"unix.ClockGettime(CLOCK_MONOTONIC) returns an error: seccomp/containersandbox blocking clock_gettime, unsupported platform build, or gVisor-like runtimes lacking the syscall.","commonSituations":"Tight container seccomp profiles that don't allow clock_gettime; gVisor/Kata runtimes with incomplete syscall emulation; porting the code to non-Linux unix-like systems.","solutions":["Inspect the wrapped errno to identify the failing cause","Relax the seccomp/container profile to permit clock_gettime(CLOCK_MONOTONIC)","Test on the host with `docker run --rm alpine date` inside the same sandbox to confirm syscall availability","Update the container runtime (gVisor etc.) to a version supporting CLOCK_MONOTONIC"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"mtime, err := bpf.GetMtime()\nif err != nil {\n    // CLOCK_MONOTONIC unavailable (seccomp/sandbox); fail fast or use fallback source\n    return fmt.Errorf(\"monotonic clock unavailable: %w\", err)\n}","preventionTips":["Allow clock_gettime in container seccomp profiles","Test workloads on the target runtime (gVisor/Kata) before deploying","Avoid exotic sandbox runtimes for datapath components","Keep the container runtime updated"],"tags":["linux","time","syscall","clock","seccomp"],"backgroundTag":"clock-gettime-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}