{"record":{"id":"a2cdc56e3bc15643","repo":"valyala/fasthttp","slug":"cannot-enable-tcp-defer-accept-s","errorCode":null,"errorMessage":"cannot enable tcp_defer_accept: %s","messagePattern":"cannot enable tcp_defer_accept: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tcplisten/tcplisten_linux.go","lineNumber":21,"sourceCode":"package tcplisten\n\nimport (\n\t\"fmt\"\n\t\"os\"\n\t\"strconv\"\n\t\"strings\"\n\n\t\"golang.org/x/sys/unix\"\n)\n\nconst (\n\tsoReusePort = 0x0F\n\ttcpFastOpen = 0x17\n)\n\nfunc enableDeferAccept(fd int) error {\n\tif err := unix.SetsockoptInt(fd, unix.IPPROTO_TCP, unix.TCP_DEFER_ACCEPT, 1); err != nil {\n\t\treturn fmt.Errorf(\"cannot enable tcp_defer_accept: %s\", err)\n\t}\n\treturn nil\n}\n\nfunc enableFastOpen(fd int) error {\n\tif err := unix.SetsockoptInt(fd, unix.SOL_TCP, tcpFastOpen, fastOpenQlen); err != nil {\n\t\treturn fmt.Errorf(\"cannot enable tcp_fastopen(qlen=%d): %s\", fastOpenQlen, err)\n\t}\n\treturn nil\n}\n\nconst fastOpenQlen = 16 * 1024\n\nfunc soMaxConn() (int, error) {\n\tdata, err := os.ReadFile(soMaxConnFilePath)\n\tif err != nil {\n\t\t// This error may trigger on travis build. Just use SOMAXCONN\n\t\tif os.IsNotExist(err) {","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/tcplisten/tcplisten_linux.go#L3-L39","documentation":"tcplisten can set TCP_DEFER_ACCEPT on Linux so accept(2) only returns once data arrives. enableDeferAccept applies the setsockopt and wraps any kernel refusal as \"cannot enable tcp_defer_accept\". It is triggered when the DeferAccept option is enabled in Config and NewListener calls fdSetup.","triggerScenarios":"NewListener with Config{DeferAccept: true} on Linux where setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, 1) fails — kernel without TCP_DEFER_ACCEPT support, hardened LSM/seccomp blocking the socket option, or an invalid fd.","commonSituations":"Running in containers with restricted syscalls; exotic kernels or gVisor/sandboxed runtimes lacking TCP_DEFER_ACCEPT; very old kernels.","solutions":["Set Config.DeferAccept to false if the environment does not support it","Verify kernel support: grep TCP_DEFER_ACCEPT /proc/net/... or check kernel version >= 2.4","Check seccomp/LSM policies allow setsockopt with IPPROTO_TCP","Confirm the runtime is real Linux, not an emulator lacking the option"],"exampleFix":"// before\ncfg := tcplisten.Config{DeferAccept: true} // fails on restricted kernel\n// after\ncfg := tcplisten.Config{DeferAccept: isLinuxWithDeferAccept()} // gate the option\nln, err := tcplisten.NewListener(cfg, \"tcp\", \":8080\")","handlingStrategy":"fallback","validationCode":"func deferAcceptSupported() bool {\n    if runtime.GOOS != \"linux\" { return false }\n    data, err := os.ReadFile(\"/proc/sys/net/ipv4/tcp_available_congestion_control\") // presence check only\n    return err == nil && len(data) > 0 // combine with kernel >= 2.4 check\n}","typeGuard":null,"tryCatchPattern":"cfg := tcplisten.Config{DeferAccept: wantDeferAccept}\nln, err := tcplisten.NewListener(cfg, \"tcp\", addr)\nif err != nil && strings.Contains(err.Error(), \"tcp_defer_accept\") {\n    log.Warn(\"TCP_DEFER_ACCEPT unsupported; retrying without it\")\n    cfg.DeferAccept = false\n    ln, err = tcplisten.NewListener(cfg, \"tcp\", addr)\n}","preventionTips":["Gate DeferAccept on kernel version/runtime detection","Verify the option works in your container runtime (gVisor etc.) before enabling","Keep a config flag to disable socket options per environment"],"tags":["linux","tcp","defer-accept","sockopt"],"backgroundTag":"setsockopt-tcp-defer-accept-failed","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}