{"record":{"id":"501c94503a108b02","repo":"hashicorp/nomad","slug":"failed-to-bind-mount-ns-at-s-v","errorCode":null,"errorMessage":"failed to bind mount ns at %s: %v","messagePattern":"failed to bind mount ns at (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/lib/nsutil/netns_linux.go","lineNumber":119,"sourceCode":"\t\t}\n\t\tdefer origNS.Close()\n\n\t\t// create a new netns on the current thread\n\t\terr = unix.Unshare(unix.CLONE_NEWNET)\n\t\tif err != nil {\n\t\t\terr = fmt.Errorf(\"error from unshare: %v\", err)\n\t\t\treturn\n\t\t}\n\n\t\t// Put this thread back to the orig ns, since it might get reused (pre go1.10)\n\t\tdefer origNS.Set()\n\n\t\t// bind mount the netns from the current thread (from /proc) onto the\n\t\t// mount point. This causes the namespace to persist, even when there\n\t\t// are no threads in the ns.\n\t\terr = unix.Mount(getCurrentThreadNetNSPath(), nsPath, \"none\", unix.MS_BIND, \"\")\n\t\tif err != nil {\n\t\t\terr = fmt.Errorf(\"failed to bind mount ns at %s: %v\", nsPath, err)\n\t\t}\n\t})()\n\twg.Wait()\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create namespace: %v\", err)\n\t}\n\n\treturn GetNS(nsPath)\n}\n\n// UnmountNS unmounts the NS held by the netns object\nfunc UnmountNS(nsPath string) error {\n\t// Only unmount if it's been bind-mounted (don't touch namespaces in /proc...)\n\tif strings.HasPrefix(nsPath, NetNSRunDir) {\n\t\tif err := unix.Unmount(nsPath, unix.MNT_DETACH); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to unmount NS: at %s: %w\", nsPath, err)\n\t\t}","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/lib/nsutil/netns_linux.go#L101-L137","documentation":"After unsharing, NewNS bind-mounts the thread's new namespace from /proc/<tid>/ns/net onto a persistent file under /var/run/netns. If that mount fails, this message wraps it and NewNS ultimately returns 'failed to create namespace'. The mount is what keeps the namespace alive after the thread exits.","triggerScenarios":"unix.Mount(getCurrentThreadNetNSPath(), nsPath, \"none\", MS_BIND) fails during NewNS — e.g. the target file under /var/run/netns could not be used as a mountpoint (not created, wrong fs) or mount is denied (EPERM).","commonSituations":"/var/run/netns not a shared mount (propagation lost after container restart); read-only /run; antivirus/security software interfering with mounts; leftover stale files with the target name.","solutions":["Ensure /var/run/netns is a shared mount: mount --bind /run/netns /run/netns && mount --make-shared /run/netns","Confirm the empty target file exists and is writable before the mount (library creates it; check disk/state)","Grant CAP_SYS_ADMIN to the process","Check /run is writable and has space"],"exampleFix":"// before: /run/netns lost its shared mount after container restart\n// after (entrypoint):\n// mount --make-shared /run/netns || true\nns, err := nsutil.NewNS()","handlingStrategy":"validation","validationCode":"if err := unix.Mount(\"\", \"/run/netns\", \"\", unix.MS_SHARED|unix.MS_REC, \"\"); err != nil && err != unix.EINVAL {\n    return fmt.Errorf(\"/run/netns not prepared for ns bind-mount: %v\", err)\n}\nif unix.Access(\"/run/netns\", unix.W_OK) != nil {\n    return errors.New(\"/run/netns is not writable\")\n}","typeGuard":null,"tryCatchPattern":"ns, err := nsutil.NewNS()\nif err != nil && strings.Contains(err.Error(), \"failed to bind mount ns\") {\n    return fmt.Errorf(\"could not persist netns under /run/netns; check it is a shared writable mount: %w\", err)\n}","preventionTips":["Ensure /run/netns is a shared, writable bind mount in every container instance","Re-apply 'mount --make-shared /run/netns' in entrypoints (propagation resets on restart)","Keep /run writable and monitor free space","Grant CAP_SYS_ADMIN so MS_BIND mounts succeed"],"tags":["linux","network-namespace","mount","bind-mount"],"backgroundTag":"netns-bind-mount-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}