{"record":{"id":"692da7cbd7bd67b7","repo":"cloudflare/cloudflared","slug":"error-starting-traceroute-w","errorCode":null,"errorMessage":"error starting traceroute: %w","messagePattern":"error starting traceroute: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"diagnostic/network/collector_utils.go","lineNumber":20,"sourceCode":"\nimport (\n\t\"bufio\"\n\t\"bytes\"\n\t\"fmt\"\n\t\"io\"\n\t\"os/exec\"\n)\n\ntype DecodeLineFunc func(text string) (*Hop, error)\n\nfunc decodeNetworkOutputToFile(command *exec.Cmd, decodeLine DecodeLineFunc) ([]*Hop, string, error) {\n\tstdout, err := command.StdoutPipe()\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"error piping traceroute's output: %w\", err)\n\t}\n\n\tif err := command.Start(); err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"error starting traceroute: %w\", err)\n\t}\n\n\t// Tee the output to a string to have the raw information\n\t// in case the decode call fails\n\t// This error is handled only after the Wait call below returns\n\t// otherwise the process can become a zombie\n\tbuf := bytes.NewBuffer([]byte{})\n\ttee := io.TeeReader(stdout, buf)\n\thops, err := Decode(tee, decodeLine)\n\t// regardless of success of the decoding\n\t// consume all output to have available in buf\n\t_, _ = io.ReadAll(tee)\n\n\tif werr := command.Wait(); werr != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"error finishing traceroute: %w\", werr)\n\t}\n\n\tif err != nil {","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/diagnostic/network/collector_utils.go#L2-L38","documentation":"decodeNetworkOutputToFile calls command.Start() to launch traceroute after wiring the stdout pipe. If the process cannot be started — binary missing, not executable, fork/exec failure — this wrapped error is returned and no hops are collected. It is the standard os/exec Start failure surfaced through the diagnostic network collector.","triggerScenarios":"network Collect invoked on a host where the traceroute binary does not exist in PATH, lacks the execute bit, or where fork/exec fails (resource limits, security policy blocking exec).","commonSituations":"Minimal container images without traceroute installed; PATH stripped in systemd services; AppArmor/seccomp policies blocking exec; missing CAP_NET_RAW for raw-socket traceroute modes (may fail at start depending on the mode).","solutions":["Verify traceroute is installed: which traceroute; install it (apt-get install traceroute / apk add traceroute).","Check the PATH used by the process running cloudflared and add the traceroute location.","Confirm the binary is executable and permitted by the security policy (seccomp/AppArmor/SELinux).","Run the diagnostic manually with the same user to reproduce and see the underlying exec error."],"exampleFix":"// before\n# container: trace fails\nFROM alpine\n// after\nFROM alpine\nRUN apk add --no-cache traceroute","handlingStrategy":"validation","validationCode":"if _, err := exec.LookPath(\"traceroute\"); err != nil {\n\treturn fmt.Errorf(\"traceroute not installed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"hops, _, err := network.Collect(ctx, cfg)\nvar ee *exec.Error\nif errors.As(err, &ee) && errors.Is(ee.Err, exec.ErrNotFound) {\n\t// install traceroute or fix PATH before retrying\n}","preventionTips":["Ensure traceroute is installed in containers/minimal images","Verify PATH inside systemd units includes the binary location","Check security policies (seccomp/AppArmor) allow exec of traceroute","Smoke-test traceroute manually after image or policy changes"],"tags":["diagnostics","network","traceroute","exec"],"backgroundTag":"command-not-found","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}