{"record":{"id":"a6f09d1d9adde1ea","repo":"netbirdio/netbird","slug":"reset-nftables-manager-w","errorCode":null,"errorMessage":"reset nftables manager: %w","messagePattern":"reset nftables manager: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/firewall/nftables/state_linux.go","lineNumber":43,"sourceCode":"\tInterfaceState *InterfaceState `json:\"interface_state,omitempty\"`\n}\n\nfunc (s *ShutdownState) Name() string {\n\treturn \"nftables_state\"\n}\n\nfunc (s *ShutdownState) Cleanup() error {\n\tmtu := s.InterfaceState.MTU\n\tif mtu == 0 {\n\t\tmtu = iface.DefaultMTU\n\t}\n\tnft, err := Create(s.InterfaceState, mtu)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create nftables manager: %w\", err)\n\t}\n\n\tif err := nft.Close(nil); err != nil {\n\t\treturn fmt.Errorf(\"reset nftables manager: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":25,"sourceCodeEnd":48,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/firewall/nftables/state_linux.go#L25-L48","documentation":"Returned by ShutdownState.Cleanup (client/firewall/nftables/state_linux.go:43) when nft.Close(nil) fails. Close flushes the teardown of the netbird-managed nftables objects (chains/table created during this recovery Create), so failure means the kernel refused the cleanup batch: EPERM, the table already deleted by another client (ENOENT), or a netlink I/O error. The leftover state this error implies is leftover nftables rules, not lost connectivity.","triggerScenarios":"Another nftables client (operator, firewalld, a second agent instance) removed the netbird table between Create and Close; capabilities dropped mid-run; netlink socket closed during namespace teardown.","commonSituations":"Crash-recovery racing with an operator manually cleaning nftables; two agent processes recovering the same state; container runtime tearing down the net namespace while cleanup runs.","solutions":["Re-run the recovery once after verifying privileges; a recreated manager's Close will flush whatever objects still exist","Check 'nft list ruleset' for residual netbird chains/table and delete them manually if cleanup keeps failing","Ensure only one agent instance performs state recovery at a time (lock file / single daemon instance)","Treat ENOENT-class failures as success: the state to clean is already gone"],"exampleFix":"// before\nif err := nft.Close(nil); err != nil {\n    return fmt.Errorf(\"reset nftables manager: %w\", err)\n}\n// after\nif err := nft.Close(nil); err != nil {\n    if isNotExistErr(err) {\n        return nil\n    }\n    return fmt.Errorf(\"reset nftables manager: %w\", err)\n}","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := shutdownState.Cleanup(); err != nil {\n    switch {\n    case isNotExistErr(rootCause(err)):\n        return nil // objects already cleaned\n    default:\n        log.Warnf(\"nftables leftovers may remain until reboot: %v\", err)\n        return nil\n    }\n}","preventionTips":["Prevent concurrent nftables cleanup of the netbird table (single agent instance)","Reboot or 'nft delete table' clears leftovers if cleanup keeps failing","Treat cleanup failure as a warning in the restore path, never as agent-fatal"],"tags":["nftables","cleanup","recovery","linux"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}