{"record":{"id":"8dd047d443ae00dd","repo":"hashicorp/nomad","slug":"failed-to-detect-iptables-w","errorCode":null,"errorMessage":"failed to detect iptables: %w","messagePattern":"failed to detect iptables: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_cni.go","lineNumber":612,"sourceCode":"\tportMap := getPortMapping(alloc, c.ignorePortMappingHostIP)\n\n\tif err := c.cni.Remove(ctx, alloc.ID, spec.Path, cni.WithCapabilityPortMap(portMap.ports)); err != nil {\n\t\tc.logger.Warn(\"error from cni.Remove; attempting manual iptables cleanup\", \"err\", err)\n\n\t\t// best effort cleanup ipv6\n\t\tipt, iptErr := c.newIPTables(structs.NodeNetworkAF_IPv6)\n\t\tif iptErr != nil {\n\t\t\tc.logger.Debug(\"failed to detect ip6tables\", \"error\", iptErr)\n\t\t} else {\n\t\t\tif err := c.forceCleanup(ipt, alloc.ID); err != nil {\n\t\t\t\tc.logger.Warn(\"failed to cleanup iptables\", \"error\", err)\n\t\t\t}\n\t\t}\n\n\t\t// create a real handle to iptables\n\t\tipt, iptErr = c.newIPTables(structs.NodeNetworkAF_IPv4)\n\t\tif iptErr != nil {\n\t\t\treturn fmt.Errorf(\"failed to detect iptables: %w\", iptErr)\n\t\t}\n\t\t// most likely the pause container was removed from underneath nomad\n\t\treturn c.forceCleanup(ipt, alloc.ID)\n\t}\n\n\treturn nil\n}\n\nvar (\n\t// ipRuleRe is used to parse a postrouting iptables rule created by nomad, e.g.\n\t//   -A POSTROUTING -s 172.26.64.191/32 -m comment --comment \"name: \\\"nomad\\\" id: \\\"6b235529-8111-4bbe-520b-d639b1d2a94e\\\"\" -j CNI-50e58ea77dc52e0c731e3799\n\tipRuleRe = regexp.MustCompile(`-A POSTROUTING -s (\\S+) -m comment --comment \"name: \\\\\"nomad\\\\\" id: \\\\\"([[:xdigit:]-]+)\\\\\"\" -j (CNI-[[:xdigit:]]+)`)\n)\n\n// forceCleanup is the backup plan for removing the iptables rule and chain associated with\n// an allocation that was using bridge networking. The cni library refuses to handle a\n// dirty state - e.g. the pause container is removed out of band, and so we must cleanup\n// iptables ourselves to avoid leaking rules.","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_cni.go#L594-L630","documentation":"During Teardown's best-effort manual iptables cleanup, constructing the IPTables handle (newIPTables) failed - iptables binary missing or not executable - so leftover rules for the alloc cannot be purged automatically.","triggerScenarios":"Thrown at client/allocrunner/networking_cni.go:612 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Install iptables on the client host and ensure it is in PATH","Verify execute permissions on iptables/ip6tables binaries","Manually remove leftover CNI-* chains/rules for the alloc ID"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}