{"record":{"id":"9940f19c443ee3a1","repo":"go-delve/delve","slug":"could-not-set-options-for-new-traced-thread-d-s","errorCode":null,"errorMessage":"could not set options for new traced thread %d %s","messagePattern":"could not set options for new traced thread (.+?) (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/native/proc_linux.go","lineNumber":383,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif status.Exited() {\n\t\t\treturn nil, fmt.Errorf(\"thread already exited %d\", pid)\n\t\t}\n\t}\n\n\tdbp.execPtraceFunc(func() { err = syscall.PtraceSetOptions(tid, ptraceOptions) })\n\tif err == syscall.ESRCH {\n\t\tif _, _, err = dbp.waitFast(tid); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error while waiting after adding thread: %d %s\", tid, err)\n\t\t}\n\t\tdbp.execPtraceFunc(func() { err = syscall.PtraceSetOptions(tid, ptraceOptions) })\n\t\tif err == syscall.ESRCH {\n\t\t\treturn nil, err\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not set options for new traced thread %d %s\", tid, err)\n\t\t}\n\t}\n\n\tdbp.threads[tid] = &nativeThread{\n\t\tID:  tid,\n\t\tdbp: dbp,\n\t\tos:  new(osSpecificDetails),\n\t}\n\tif dbp.memthread == nil {\n\t\tdbp.memthread = dbp.threads[tid]\n\t}\n\tfor _, bp := range dbp.Breakpoints().M {\n\t\tif bp.WatchType != 0 {\n\t\t\terr := dbp.threads[tid].writeHardwareBreakpoint(bp.Addr, bp.WatchType, bp.HWBreakIndex)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/native/proc_linux.go#L365-L401","documentation":"Delve attached to a new thread and consumed its initial stop, but the second PtraceSetOptions call (after the ESRCH recovery wait) failed with an error other than ESRCH. Without these options (PTRACE_O_TRACECLONE and optionally exec/fork tracing) the debugger cannot automatically track child threads, breaking thread and process follow behavior.","triggerScenarios":"addThread: after the ESRCH-retry path, syscall.PtraceSetOptions(tid, ptraceOptions) returns a non-ESRCH, non-nil error — e.g. EINVAL from invalid option combination on the kernel, EPERM from security restrictions, or EIO if the thread is in an unexpected state.","commonSituations":"Running on kernels/containers that restrict ptrace options (seccomp filters blocking ptrace); attaching to processes in uninterruptible states (D state) causing EIO; sandboxed CI environments (gVisor, some Docker seccomp profiles) with incomplete ptrace support.","solutions":["Run the debugger with elevated privileges (root or CAP_SYS_PTRACE) and confirm the container seccomp profile allows ptrace (Docker: --cap-add=SYS_PTRACE --security-opt seccomp=unconfined).","Check kernel compatibility: gVisor/Kata containers may not support all PTRACE_O_* options; run on a standard kernel.","Verify the thread's state via /proc/<pid>/task/<tid>/stat — threads stuck in D state can't respond to ptrace requests until they return to the run queue.","Retry the debugger session; transient states usually clear."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// check the environment supports ptrace options before launching\nfunc ptraceEnvOK() error {\n    if os.Getenv(\"KUBERNETES_SERVICE_HOST\") != \"\" {\n        if _, err := os.Stat(\"/proc/sys/kernel/yama/ptrace_scope\"); err != nil {\n            return fmt.Errorf(\"check container seccomp profile allows ptrace\")\n        }\n    }\n    if os.Geteuid() != 0 {\n        return fmt.Errorf(\"run with root or CAP_SYS_PTRACE for full ptrace option support\")\n    }\n    return nil\n}","typeGuard":"func isSetOptionsErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"could not set options for new traced thread\")\n}","tryCatchPattern":"if err := startDebug(); err != nil {\n    if isSetOptionsErr(err) {\n        return fmt.Errorf(\"%w; ensure container has SYS_PTRACE and default seccomp profile is not blocking ptrace\", err)\n    }\n    return err\n}","preventionTips":["Run containers with --cap-add=SYS_PTRACE (Docker) or equivalent Kubernetes securityContext capabilities","Avoid gVisor/Kata sandboxes for debugging workloads — their ptrace support is incomplete","Confirm seccomp profiles permit ptrace syscalls","Check target thread state in /proc — threads in D state may reject ptrace requests"],"tags":["linux","ptrace","kernel","permissions"],"backgroundTag":"ptrace-setoptions-failed","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}