{"record":{"id":"a7051e76d2a1e480","repo":"jdx/mise","slug":"no-supported-firewall-backend-found-tried-nft-fi","errorCode":null,"errorMessage":"no supported firewall backend found (tried nft, firewall-cmd, and ufw)","messagePattern":"no supported firewall backend found \\(tried nft, firewall-cmd, and ufw\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall.rs","lineNumber":976,"sourceCode":"        && backend_available(state.backend)\n    {\n        return Ok(state.backend);\n    }\n    for backend in [FirewallBackend::Firewalld, FirewallBackend::Ufw] {\n        if backend_available(backend) && backend_active(backend) {\n            return Ok(backend);\n        }\n    }\n    for backend in [\n        FirewallBackend::Nftables,\n        FirewallBackend::Firewalld,\n        FirewallBackend::Ufw,\n    ] {\n        if backend_available(backend) {\n            return Ok(backend);\n        }\n    }\n    bail!(\"no supported firewall backend found (tried nft, firewall-cmd, and ufw)\")\n}\n\nfn ensure_backend_available(backend: FirewallBackend) -> Result<()> {\n    if backend_available(backend) {\n        Ok(())\n    } else {\n        bail!(\n            \"firewall backend '{}' requires command '{}'\",\n            backend.label(),\n            backend.program().unwrap_or_default()\n        )\n    }\n}\n\nfn backend_available(backend: FirewallBackend) -> bool {\n    backend.program().and_then(crate::file::which).is_some()\n}\n","sourceCodeStart":958,"sourceCodeEnd":994,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/firewall.rs#L958-L994","documentation":"mise drives the Linux firewall through one of three backends — nftables (`nft`), firewalld (`firewall-cmd`), or ufw (`ufw`) — and auto-detection probes each for its CLI command on PATH. This error means none of the three was found, so there is no way to inspect or converge the `[bootstrap.linux.firewall]` config. Install one of the tools (nftables is preferred) or make its binary visible to mise.","triggerScenarios":"`mise bootstrap firewall apply`/`status` (or a full `mise bootstrap` that includes the firewall part) on a host where `command -v nft firewall-cmd ufw` all fail: minimal containers, stripped cloud images, or a PATH that excludes /usr/sbin and /usr/sbin where these tools live, especially under sudo's secure_path.","commonSituations":"Minimal Docker/Podman images used as dev environments; slim cloud images with no firewall package preinstalled; running via sudo where secure_path omits /usr/sbin:/sbin; config copied from a server to a container that has no firewall stack.","solutions":["Install a backend: `apt install nftables` (Debian/Ubuntu), `dnf install firewalld` (RHEL-family), or `apt install ufw`.","If the tool is installed but hidden, run with a full PATH: `sudo env PATH=\"$PATH:/usr/sbin:/sbin\" mise bootstrap firewall status`.","If this host should not manage a firewall, skip the part: `mise bootstrap --skip firewall`.","Remove or comment out `[bootstrap.linux.firewall]` if the config was copied from a different host."],"exampleFix":"# before\nmise bootstrap firewall apply\n# error: no supported firewall backend found (tried nft, firewall-cmd, and ufw)\n\n# after\nsudo apt install -y nftables\nmise bootstrap firewall apply","handlingStrategy":"fallback","validationCode":"# pre-flight: at least one backend command must exist\ncommand -v nft >/dev/null || command -v firewall-cmd >/dev/null || command -v ufw >/dev/null \\\n  || { echo 'no firewall backend; install nftables, firewalld, or ufw'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-install nftables in base images and provisioning scripts.","Run `mise bootstrap firewall status` early to detect backend availability.","Under sudo, remember secure_path may hide /usr/sbin — test with the same invocation path you will use."],"tags":["mise","firewall","backend","missing-dependency","path","bootstrap","linux"],"backgroundTag":"missing-system-dependency","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}