{"record":{"id":"68122ecf3b7a3f53","repo":"containerd/containerd","slug":"error-setting-loopback-interface-up-w","errorCode":null,"errorMessage":"error setting loopback interface up: %w","messagePattern":"error setting loopback interface up: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/sandbox_run_linux.go","lineNumber":39,"sourceCode":"\t\"syscall\"\n\n\t\"github.com/containerd/containerd/v2/pkg/netns\"\n\t\"github.com/containerd/containerd/v2/pkg/sys\"\n\n\t\"github.com/containernetworking/plugins/pkg/ns\"\n\t\"github.com/vishvananda/netlink\"\n\truntime \"k8s.io/cri-api/pkg/apis/runtime/v1\"\n)\n\nfunc (c *criService) bringUpLoopback(netns string) error {\n\tif err := ns.WithNetNSPath(netns, func(_ ns.NetNS) error {\n\t\tlink, err := netlink.LinkByName(\"lo\")\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn netlink.LinkSetUp(link)\n\t}); err != nil {\n\t\treturn fmt.Errorf(\"error setting loopback interface up: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc (c *criService) setupNetnsWithinUserns(netnsMountDir string, opt *runtime.UserNamespace) (*netns.NetNS, error) {\n\tif opt.GetMode() != runtime.NamespaceMode_POD {\n\t\treturn nil, fmt.Errorf(\"required pod-level user namespace setting\")\n\t}\n\n\tuidMaps := opt.GetUids()\n\tif len(uidMaps) != 1 {\n\t\treturn nil, fmt.Errorf(\"required only one uid mapping, but got %d uid mapping(s)\", len(uidMaps))\n\t}\n\tif uidMaps[0] == nil {\n\t\treturn nil, fmt.Errorf(\"required only one uid mapping, but got empty uid mapping\")\n\t}\n\n\tgidMaps := opt.GetGids()","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/sandbox_run_linux.go#L21-L57","documentation":"bringUpLoopback wraps all failures of its netns.Do closure (netlink.LinkByName(\"lo\") or netlink.LinkSetUp) with this message. It is only invoked when UseInternalLoopback is enabled, meaning containerd itself must raise the loopback device inside the newly created pod network namespace.","triggerScenarios":"RunPodSandbox -> setupPodNetwork -> bringUpLoopback: entering the netns fails, 'lo' is not found in the namespace, or the netlink LinkSetUp call is denied (missing CAP_NET_ADMIN, LSM policy).","commonSituations":"Rootless setups where the runtime lacks privileges in the userns; hardened AppArmor/SELinux profiles blocking netlink; kernel configurations without loopback in new netns; netns fd already closed.","solutions":["Set use_internal_loopback=false and let the CNI loopback plugin handle 'lo'","Run containerd with sufficient privileges (root or properly delegated userns mappings)","Check dmesg/audit logs for LSM denials and update policies to permit RTM_SETLINK","Verify kernel/netns support: confirm 'lo' exists in a fresh netns (ip netns exec test ip link)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func ensureLoopbackPrivileges() error {\n    if os.Geteuid() != 0 { return fmt.Errorf(\"need root for netlink\") }\n    return capability.Check(capability.CAP_NET_ADMIN)\n}","typeGuard":null,"tryCatchPattern":"err := bringUpLoopback(path)\nvar linkErr netlink.LinkNotFoundError\nswitch {\ncase errors.As(err, &linkErr): // 'lo' absent in netns\ncase errors.Is(err, os.ErrPermission): // add CAP_NET_ADMIN or userns mapping\ndefault:\n    log.Error(err)\n}","preventionTips":["Disable use_internal_loopback unless explicitly required","Run containerd unprivileged only with correct rootless userns delegation","Keep LSM profiles updated to allow netlink operations","Smoke-test netns creation after kernel upgrades"],"tags":["network","netlink","loopback","linux"],"backgroundTag":"loopback-interface-setup-failed","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}