{"record":{"id":"66df760a6281bb9f","repo":"cilium/cilium","slug":"create-netlink-handle-w","errorCode":null,"errorMessage":"create netlink handle: %w","messagePattern":"create netlink handle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/probes/probes.go","lineNumber":808,"sourceCode":"\t} else {\n\t\treturn ErrNotSupported\n\t}\n})\n\n// Probes whether the kernel supports BIG TCP for VXLAN and GENEVE.\nvar HaveBIGTCPTunnel = sync.OnceValue(func() error {\n\tns, err := netns.New()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create netns: %w\", err)\n\t}\n\tdefer ns.Close()\n\n\tvar h *netlink.Handle\n\tif err := ns.Do(func() (err error) {\n\t\th, err = netlink.NewHandle()\n\t\treturn err\n\t}); err != nil {\n\t\treturn fmt.Errorf(\"create netlink handle: %w\", err)\n\t}\n\tdefer h.Close()\n\n\tconst probeNetdev = \"probe\"\n\n\tdev := &netlink.Geneve{\n\t\tLinkAttrs: netlink.LinkAttrs{\n\t\t\tName: probeNetdev,\n\t\t},\n\t\tDport: defaults.TunnelPortGeneve,\n\t}\n\n\tif err := h.LinkAdd(dev); err != nil {\n\t\treturn fmt.Errorf(\"failed to create a probe GENEVE device: %w\", err)\n\t}\n\n\tlink, err := safenetlink.WithRetryResult(func() (netlink.Link, error) {\n\t\t//nolint:forbidigo","sourceCodeStart":790,"sourceCodeEnd":826,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/probes/probes.go#L790-L826","documentation":"Within HaveBIGTCPTunnel, a netlink handle is created inside the probe network namespace via netlink.NewHandle(). Failure to open a rtnetlink socket is wrapped as 'create netlink handle'.","triggerScenarios":"netlink.NewHandle() inside ns.Do fails — typically due to missing CAP_NET_ADMIN in the new namespace or rtnetlink socket creation being restricted.","commonSituations":"Containers lacking NET_ADMIN; SELinux/seccomp blocking NETLINK_ROUTE socket creation; file descriptor exhaustion (EMFILE).","solutions":["Add CAP_NET_ADMIN to the process","Check ulimit -n for fd exhaustion","Verify seccomp/SELinux policy allows socket(AF_NETLINK, NETLINK_ROUTE)","Confirm kernel rtnetlink support"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// open a rtnetlink socket to verify netlink is usable\nh, err := netlink.NewHandle()\nif err != nil { return fmt.Errorf(\"netlink unavailable: %w\", err) }\nh.Close()","typeGuard":"var syscallErrno syscall.Errno\nif errors.As(err, &syscallErrno) && syscallErrno == syscall.EMFILE { /* fd exhaustion */ }","tryCatchPattern":"if err := probes.HaveBIGTCPTunnel(); err != nil {\n    if strings.Contains(err.Error(), \"create netlink handle\") { /* check caps/fds/seccomp */ }\n    return err\n}","preventionTips":["Grant CAP_NET_ADMIN","Raise RLIMIT_NOFILE if handles are exhausted","Ensure seccomp/SELinux permits socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE)"],"tags":["linux","netlink","bigtcp","capabilities"],"backgroundTag":"netlink-handle-creation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}