{"record":{"id":"5612ab5d74cd2e80","repo":"hashicorp/nomad","slug":"failed-to-create-namespace-v","errorCode":null,"errorMessage":"failed to create namespace: %v","messagePattern":"failed to create namespace: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/lib/nsutil/netns_linux.go","lineNumber":125,"sourceCode":"\t\t\terr = fmt.Errorf(\"error from unshare: %v\", err)\n\t\t\treturn\n\t\t}\n\n\t\t// Put this thread back to the orig ns, since it might get reused (pre go1.10)\n\t\tdefer origNS.Set()\n\n\t\t// bind mount the netns from the current thread (from /proc) onto the\n\t\t// mount point. This causes the namespace to persist, even when there\n\t\t// are no threads in the ns.\n\t\terr = unix.Mount(getCurrentThreadNetNSPath(), nsPath, \"none\", unix.MS_BIND, \"\")\n\t\tif err != nil {\n\t\t\terr = fmt.Errorf(\"failed to bind mount ns at %s: %v\", nsPath, err)\n\t\t}\n\t})()\n\twg.Wait()\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create namespace: %v\", err)\n\t}\n\n\treturn GetNS(nsPath)\n}\n\n// UnmountNS unmounts the NS held by the netns object\nfunc UnmountNS(nsPath string) error {\n\t// Only unmount if it's been bind-mounted (don't touch namespaces in /proc...)\n\tif strings.HasPrefix(nsPath, NetNSRunDir) {\n\t\tif err := unix.Unmount(nsPath, unix.MNT_DETACH); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to unmount NS: at %s: %w\", nsPath, err)\n\t\t}\n\n\t\tif err := os.Remove(nsPath); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to remove ns path %s: %w\", nsPath, err)\n\t\t}\n\t}\n","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/lib/nsutil/netns_linux.go#L107-L143","documentation":"This is the top-level failure reported by NewNS when any step inside the per-thread creation goroutine (get current ns, unshare, bind mount) failed. It wraps the inner error, so the root cause (permissions, mount failure) is in the wrapped message. Receiving it means no usable network namespace was created.","triggerScenarios":"NewNS (via CreateNetwork) returns this whenever the inner err from the goroutine is non-nil — most commonly unshare EPERM or bind-mount failure of the new ns onto /var/run/netns/<name>.","commonSituations":"Running tests as unprivileged user on CI; containers missing SYS_ADMIN; environments where /run is read-only or not shared; Kernel without NET_NS support.","solutions":["Read the wrapped cause and fix accordingly (usually CAP_SYS_ADMIN or mount propagation)","Run with sufficient privileges: sudo, --privileged, or --cap-add SYS_ADMIN","Pre-configure /run/netns as a shared bind mount on the host","Validate with 'unshare -n true' that the environment supports netns creation at all"],"exampleFix":"// before\nns, err := nsutil.NewNS() // failed to create namespace: error from unshare: operation not permitted\n// after: run the binary with the needed capability\n// setcap cap_sys_admin+ep /usr/local/bin/mybin\nns, err := nsutil.NewNS()","handlingStrategy":"try-catch","validationCode":"if err := exec.Command(\"unshare\", \"-n\", \"true\").Run(); err != nil {\n    return fmt.Errorf(\"netns creation unsupported in this environment: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"ns, err := nsutil.NewNS()\nvar nsErr *netnsError\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to create namespace\") {\n        log.Fatalf(\"netns unavailable: %v (run with CAP_SYS_ADMIN and shared /run/netns)\", err)\n    }\n    return err\n}","preventionTips":["Fail fast with an environment capability check at startup","Standardize privileged requirements in deployment manifests (capabilities: SYS_ADMIN)","Keep /run/netns shared-mount setup in infrastructure-as-code","Pin runtime/kernel versions known to support netns in your CI matrix"],"tags":["linux","network-namespace","privileges"],"backgroundTag":"netns-creation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}