{"record":{"id":"9b5f17822b7ebbd8","repo":"hashicorp/nomad","slug":"failed-to-parse-postrouting-rule-for-alloc-s","errorCode":null,"errorMessage":"failed to parse postrouting rule for alloc %s","messagePattern":"failed to parse postrouting rule for alloc (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_cni.go","lineNumber":663,"sourceCode":"\tmatcher := fmt.Sprintf(commentFmt, allocID)\n\tvar ruleToPurge string\n\tfor _, rule := range rules {\n\t\tif strings.Contains(rule, matcher) {\n\t\t\truleToPurge = rule\n\t\t\tbreak\n\t\t}\n\t}\n\n\t// no rule found for our allocation, just give up\n\tif ruleToPurge == \"\" {\n\t\tc.logger.Info(\"iptables cleanup: did not find postrouting rule for alloc\", \"alloc_id\", allocID)\n\t\treturn nil\n\t}\n\n\t// re-create the rule we need to delete, as tokens\n\tsubs := ipRuleRe.FindStringSubmatch(ruleToPurge)\n\tif len(subs) != 4 {\n\t\treturn fmt.Errorf(\"failed to parse postrouting rule for alloc %s\", allocID)\n\t}\n\tcidr := subs[1]\n\tid := subs[2]\n\tchainID := subs[3]\n\ttoDel := []string{\n\t\t`-s`,\n\t\tcidr,\n\t\t`-m`,\n\t\t`comment`,\n\t\t`--comment`,\n\t\t`name: \"nomad\" id: \"` + id + `\"`,\n\t\t`-j`,\n\t\tchainID,\n\t}\n\n\t// remove the jump rule\n\tok := true\n\tif err = ipt.Delete(natTable, postRoutingChain, toDel...); err != nil {","sourceCodeStart":645,"sourceCodeEnd":681,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_cni.go#L645-L681","documentation":"forceCleanup matched the alloc's POSTROUTING rule but the regex ipRuleRe extracted an unexpected number of capture groups, meaning the rule text deviates from the expected CNI format; cleanup aborts rather than deleting a misparsed rule.","triggerScenarios":"Thrown at client/allocrunner/networking_cni.go:663 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the raw rule with iptables -t nat -S POSTROUTING","Check for an unexpected CNI plugin version writing a different comment format","Remove the rule/chain manually for the alloc ID"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}