{"record":{"id":"86960003e5990954","repo":"slimtoolkit/slim","slug":"start-monitor-timeout","errorCode":null,"errorMessage":"start monitor timeout","messagePattern":"start monitor timeout","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/app/master/inspectors/container/container_inspector.go","lineNumber":65,"sourceCode":"\tfileArtifactsTar    = \"files.tar\"\n\tFileArtifactsOutTar = \"files_out.tar\"\n\t// FileArtifactsArchiveTar = \"files_archive.tar\"\n\tSensorMountPat       = \"%s:/opt/_slim/bin/slim-sensor:ro\"\n\tVolumeSensorMountPat = \"%s:/opt/_slim/bin:ro\"\n\tLabelName            = \"_slim\"\n\tMondelArtifactTar    = \"mondel.tar\"\n)\n\ntype ovars = app.OutVars\n\nvar (\n\tcmdPortStrDefault  = fmt.Sprintf(\"%d\", channel.CmdPort)\n\tcmdPortSpecDefault = dockerapi.Port(fmt.Sprintf(\"%d/tcp\", channel.CmdPort))\n\tevtPortStrDefault  = fmt.Sprintf(\"%d\", channel.EvtPort)\n\tevtPortSpecDefault = dockerapi.Port(fmt.Sprintf(\"%d/tcp\", channel.EvtPort))\n)\n\nvar ErrStartMonitorTimeout = errors.New(\"start monitor timeout\")\n\nconst (\n\tsensorVolumeBaseName = \"slim-sensor\"\n)\n\ntype NetNameInfo struct {\n\tName     string\n\tFullName string\n\tAliases  []string\n}\n\n// TODO(estroz): move all fields configured only after RunContainer is called\n// to a InspectorRunResponse struct returned by RunContainer.\n\n// Inspector is a container execution inspector\ntype Inspector struct {\n\tContainerInfo         *dockerapi.Container\n\tContainerPortsInfo    string","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/app/master/inspectors/container/container_inspector.go#L47-L83","documentation":"ErrStartMonitorTimeout is a sentinel in pkg/app/master/inspectors/container/container_inspector.go returned by RunContainer when the sensor's start monitor does not report readiness within the expected time window after launching the instrumented container. It means the slim sensor inside the target never confirmed it started monitoring.","triggerScenarios":"Running the container inspection when the sensor IPC channel fails to come up; the sensor binary can't start in the target image; the container's start event never arrives before the timeout elapses.","commonSituations":"Minimal/distroless target images missing the sensor's runtime dependencies; blocked ports (CmdPort/EvtPort) or firewall rules; very slow container startup under heavy load; SELinux/AppArmor restrictions.","solutions":["Retry the run — transient startup slowness often resolves on a second attempt","Check that the sensor's IPC ports (CmdPort/EvtPort defaults) are free and not blocked by firewall/network policy","Verify the target image can execute the sensor binary (architecture match, required libc/libraries present)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Go\nif errors.Is(err, ErrStartMonitorTimeout) {\n\t// log, then retry the run once before failing\n}","preventionTips":["Keep the sensor IPC ports free and unblocked by firewalls","Test that the target image can execute the sensor binary","Allow generous startup timeouts on loaded machines"],"tags":["docker","sensor","timeout","ipc"],"backgroundTag":"start-monitor-timeout","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}