{"record":{"id":"cc799dfaf4cbef2f","repo":"kataras/iris","slug":"s-w-cc799d","errorCode":null,"errorMessage":"%s: %w","messagePattern":"%s: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/netutil/tcp.go","lineNumber":71,"sourceCode":"func TCPKeepAlive(addr string, reuse bool, keepAliveDur time.Duration) (ln net.Listener, err error) {\n\t// if strings.HasPrefix(addr, \"127.0.0.1\") {\n\t// \t// it's ipv4, use ipv4 tcp listener instead of the default ipv6. Don't.\n\t// \tln, err = net.Listen(\"tcp4\", addr)\n\t// } else {\n\t// \tln, err = TCP(addr)\n\t// }\n\n\tln, err = TCP(addr, reuse)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn tcpKeepAliveListener{ln.(*net.TCPListener), keepAliveDur}, nil\n}\n\n// UNIX returns a new unix(file) Listener.\nfunc UNIX(socketFile string, mode os.FileMode) (net.Listener, error) {\n\tif errOs := os.Remove(socketFile); errOs != nil && !os.IsNotExist(errOs) {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", socketFile, errOs)\n\t}\n\n\tl, err := net.Listen(\"unix\", socketFile)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"port already in use: %w\", err)\n\t}\n\n\tif err = os.Chmod(socketFile, mode); err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot chmod %#o for %q: %w\", mode, socketFile, err)\n\t}\n\n\treturn l, nil\n}\n\n// TLS returns a new TLS Listener and an error on failure.\nfunc TLS(addr, certFile, keyFile string) (net.Listener, error) {\n\tif certFile == \"\" || keyFile == \"\" {\n\t\treturn nil, errors.New(\"empty certFile or KeyFile\")","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/core/netutil/tcp.go#L53-L89","documentation":"netutil.UNIX removes any existing socket file before listening; if os.Remove fails with an error other than \"not exist\" (e.g. permission denied, path is a directory), the error is wrapped with the socket path and returned.","triggerScenarios":"Calling netutil.UNIX(socketFile, mode) where socketFile exists but cannot be removed: read-only directory, the path is a directory rather than a socket, or another user owns it.","commonSituations":"Stale socket left by a crashed process owned by another user; pointing socketFile at a directory; running the app as a non-root user after a previous root run.","solutions":["Ensure the directory containing the socket is writable by the process user and that socketFile is not a directory.","Manually remove the stale socket file before starting, or run under a user that can.","Point UNIX() to a fresh path in a writable temp/run directory (e.g. /run/myapp/app.sock)."],"exampleFix":"// before\nln, _ := netutil.UNIX(\"/var/run/app.sock\", 0666) // permission denied\n// after\nln, _ := netutil.UNIX(\"/run/myapp/app.sock\", 0666) // dir owned by app user\n","handlingStrategy":"validation","validationCode":"if fi, err := os.Stat(socketFile); err == nil && fi.IsDir() {\n    return errors.New(\"socket path is a directory\")\n}\n// ensure parent dir is writable\nif err := os.MkdirAll(filepath.Dir(socketFile), 0755); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":"ln, err := netutil.UNIX(socketFile, mode)\nif err != nil {\n    if !os.IsNotExist(err) && strings.Contains(err.Error(), socketFile) {\n        os.RemoveAll(socketFile) // only if safe\n        ln, err = netutil.UNIX(socketFile, mode)\n    }\n}","preventionTips":["Run the process as the same user across restarts","Point sockets at app-owned dirs like /run/<app>/","Ensure socketFile is not a directory and the parent is writable"],"tags":["unix-socket","filesystem","permissions"],"backgroundTag":"unix-socket-remove-failed","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}