{"record":{"id":"b3e2ead19e2c9dfe","repo":"hashicorp/nomad","slug":"failed-to-create-network-for-alloc-v","errorCode":null,"errorMessage":"failed to create network for alloc: %v","messagePattern":"failed to create network for alloc: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/network_hook.go","lineNumber":146,"sourceCode":"\t// supplied hostname avoids the validation on job registrations because it\n\t// looks like it includes interpolation, when it doesn't.\n\tif interpolatedNetworks[0].Hostname != \"\" {\n\t\tif _, ok := dns.IsDomainName(interpolatedNetworks[0].Hostname); !ok {\n\t\t\treturn fmt.Errorf(\"network hostname %q is not a valid DNS name\", interpolatedNetworks[0].Hostname)\n\t\t}\n\t}\n\n\t// Our network create request.\n\tnetworkCreateReq := drivers.NetworkCreateRequest{\n\t\tHostname: interpolatedNetworks[0].Hostname,\n\t}\n\n\tvar checkedOnce bool\n\nCREATE:\n\tspec, created, err := h.manager.CreateNetwork(h.alloc.ID, &networkCreateReq)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create network for alloc: %v\", err)\n\t}\n\n\tif spec != nil {\n\t\th.spec = spec\n\t\th.isolationSetter.SetNetworkIsolation(spec)\n\t}\n\n\tif spec != nil {\n\t\tstatus, err := h.networkConfigurator.Setup(context.TODO(), h.alloc, spec, created)\n\t\tif err != nil {\n\t\t\t// if the netns already existed but is invalid, we get\n\t\t\t// ErrCNICheckFailed. We'll try to recover from this one time by\n\t\t\t// recreating the netns from scratch before giving up\n\t\t\tif errors.Is(err, ErrCNICheckFailed) && !checkedOnce {\n\t\t\t\th.logger.Warn(\"network configuration check failed\", \"error\", err)\n\t\t\t\tcheckedOnce = true\n\t\t\t\tdestroyErr := h.manager.DestroyNetwork(h.alloc.ID, spec)\n\t\t\t\tif destroyErr != nil {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/network_hook.go#L128-L164","documentation":"The network_hook's Prerun asks the client's network manager to create the allocation network (netns) via manager.CreateNetwork. Any error returned by the network manager or its underlying CNI setup is wrapped in this message and fails the allocation. The label is generic; the inner error carries the real cause.","triggerScenarios":"h.manager.CreateNetwork(h.alloc.ID, &networkCreateReq) returns a non-nil error during Prerun — bridge/CNI plugin invocation fails, bridge driver absent, or isolation mode setup fails.","commonSituations":"CNI plugins not installed or CNI_PATH misconfigured on the client; missing kernel bridge module or no root privileges; malformed CNI config (e.g. bad bridge plugin conf); IP address exhaustion in the CNI subnet; nomad client not restarted after CNI install.","solutions":["Read the inner error (%v) to identify whether it's a CNI plugin, bridge, or IPAM failure.","Ensure CNI plugins are installed and cni_path is set correctly on the client (e.g. /opt/cni/bin with bridge plugin present).","Verify the client runs with sufficient privileges (root / CAP_NET_ADMIN) and that the bridge kernel module is loaded.","Check CNI subnet/IPAM configuration for conflicts or IP exhaustion (cni_config block in client config).","Restart the nomad agent after installing/changing CNI plugins so it reloads the network manager."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-flight on the client: CNI plugins present\nif _, err := os.Stat(filepath.Join(cniPath, \"bridge\")); err != nil {\n    return fmt.Errorf(\"bridge CNI plugin missing under %s\", cniPath)\n}","typeGuard":"func cniReady(cniPath string) bool {\n    for _, p := range []string{\"bridge\", \"loopback\"} {\n        if _, err := os.Stat(filepath.Join(cniPath, p)); err != nil { return false }\n    }\n    return true\n}","tryCatchPattern":"if err := hook.Prerun(); err != nil && strings.Contains(err.Error(), \"failed to create network\") {\n    var inner = err // inspect CNI stderr in client logs\n    log.Printf(\"network create failed: %v; verify cni_path/plugins and privileges\", inner)\n}","preventionTips":["Install CNI plugins and set client cni_path before enabling bridge mode.","Run the agent with CAP_NET_ADMIN/root for bridge networking.","Validate CNI config JSON and subnets for conflicts.","Restart the agent after installing/upgrading CNI plugins."],"tags":["nomad","network","cni","bridge"],"backgroundTag":"cni-network-create-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}