{"record":{"id":"4cb2b51a8c97c590","repo":"netbirdio/netbird","slug":"create-nftables-manager-w","errorCode":null,"errorMessage":"create nftables manager: %w","messagePattern":"create nftables manager: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/nftables/state_linux.go","lineNumber":39,"sourceCode":"\treturn i.WGAddress\n}\n\ntype ShutdownState struct {\n\tInterfaceState *InterfaceState `json:\"interface_state,omitempty\"`\n}\n\nfunc (s *ShutdownState) Name() string {\n\treturn \"nftables_state\"\n}\n\nfunc (s *ShutdownState) Cleanup() error {\n\tmtu := s.InterfaceState.MTU\n\tif mtu == 0 {\n\t\tmtu = iface.DefaultMTU\n\t}\n\tnft, err := Create(s.InterfaceState, mtu)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create nftables manager: %w\", err)\n\t}\n\n\tif err := nft.Close(nil); err != nil {\n\t\treturn fmt.Errorf(\"reset nftables manager: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":21,"sourceCodeEnd":48,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/nftables/state_linux.go#L21-L48","documentation":"Raised in ShutdownState.Cleanup (client/firewall/nftables/state_linux.go:39) during crash-recovery: the agent persisted its nftables state before a shutdown, and on the next start it recreates a full nftables manager from that InterfaceState just to Close it (which flushes the leftover netbird rules/table). Create performs the whole table/chain setup over netlink and fails without CAP_NET_ADMIN, without kernel nftables support, or on any netlink handshake error.","triggerScenarios":"Agent restarted after a crash/kill without root privileges; recovery running inside a container or VM where nftables was present at write time but absent at restore time (kernel/module change, bind-mount restrictions); netlink socket creation blocked by seccomp.","commonSituations":"Host downgraded or kernel changed between runs; systemd unit lost AmbientCapabilities; agent running in privileged container where nftables module is not loaded; 'netbird down' invoked by an unprivileged helper triggering state restore.","solutions":["Run the recovery with the same privileges the agent had when it wrote the state (root or CAP_NET_ADMIN)","Verify nftables availability first: 'nft list ruleset' as the same user; load nf_tables module if missing","If the environment intentionally lost nftables support, clear the persisted shutdown state file so cleanup is skipped on subsequent starts","Log and continue (the leftover rules die with the old table lifetime / reboot) rather than blocking agent startup on cleanup failure"],"exampleFix":"// before\nnft, err := Create(s.InterfaceState, mtu)\nif err != nil {\n    return fmt.Errorf(\"create nftables manager: %w\", err)\n}\n// after - skip cleanup when nftables is unavailable in the current environment\nif !nftablesAvailable() {\n    log.Warn(\"nftables unavailable, skipping shutdown-state cleanup\")\n    return nil\n}\nnft, err := Create(s.InterfaceState, mtu)\nif err != nil {\n    return fmt.Errorf(\"create nftables manager: %w\", err)\n}","handlingStrategy":"validation","validationCode":"// before attempting crash-recovery cleanup\nif os.Geteuid() != 0 && !hasCapNetAdmin() {\n    log.Warn(\"skipping nftables shutdown-state cleanup: insufficient privileges\")\n    return nil\n}","typeGuard":"func nftablesAvailable() bool {\n    f, err := os.Open(\"/proc/net/netfilter/nfnetlink_queue\")\n    if err == nil {\n        f.Close()\n    }\n    c, err := net.Dial(\"unix\", \"\") // probe replaced by exec probe below\n    _ = c\n    return exec.Command(\"nft\", \"list\", \"ruleset\").Run() == nil\n}","tryCatchPattern":"if err := shutdownState.Cleanup(); err != nil {\n    if isPermissionErr(err) || isNotExistErr(err) {\n        log.Warnf(\"nftables cleanup skipped: %v\", err)\n        return // do not block startup on cleanup\n    }\n    return err\n}","preventionTips":["Preserve agent privileges between the crash and the recovery run","Run 'netbird service reinstall' after capability changes instead of manual restarts","Clear persisted shutdown state when migrating to environments without nftables"],"tags":["nftables","recovery","startup","permissions","linux"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}