{"record":{"id":"e0980426ec6283c2","repo":"slackhq/nebula","slug":"could-not-create-netstack-nic-v","errorCode":null,"errorMessage":"could not create netstack NIC: %v","messagePattern":"could not create netstack NIC: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"service/service.go","lineNumber":84,"sourceCode":"\teg, ctx := errgroup.WithContext(ctx)\n\ts := Service{\n\t\teg:      eg,\n\t\tcontrol: control,\n\t}\n\ts.mu.listeners = map[uint16]*tcpListener{}\n\n\ts.ipstack = stack.New(stack.Options{\n\t\tNetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},\n\t\tTransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol, udp.NewProtocol, icmp.NewProtocol4, icmp.NewProtocol6},\n\t})\n\tsackEnabledOpt := tcpip.TCPSACKEnabled(true) // TCP SACK is disabled by default\n\ttcpipErr := s.ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &sackEnabledOpt)\n\tif tcpipErr != nil {\n\t\treturn nil, fmt.Errorf(\"could not enable TCP SACK: %v\", tcpipErr)\n\t}\n\tlinkEP := channel.New( /*size*/ 512 /*mtu*/, 1280, \"\")\n\tif tcpipProblem := s.ipstack.CreateNIC(nicID, linkEP); tcpipProblem != nil {\n\t\treturn nil, fmt.Errorf(\"could not create netstack NIC: %v\", tcpipProblem)\n\t}\n\tipv4Subnet, _ := tcpip.NewSubnet(tcpip.AddrFrom4([4]byte{0x00, 0x00, 0x00, 0x00}), tcpip.MaskFrom(strings.Repeat(\"\\x00\", 4)))\n\ts.ipstack.SetRouteTable([]tcpip.Route{\n\t\t{\n\t\t\tDestination: ipv4Subnet,\n\t\t\tNIC:         nicID,\n\t\t},\n\t})\n\n\tipNet := device.Networks()\n\tpa := tcpip.ProtocolAddress{\n\t\tAddressWithPrefix: tcpip.AddrFromSlice(ipNet[0].Addr().AsSlice()).WithPrefix(),\n\t\tProtocol:          ipv4.ProtocolNumber,\n\t}\n\tif err := s.ipstack.AddProtocolAddress(nicID, pa, stack.AddressProperties{\n\t\tPEB:        stack.CanBePrimaryEndpoint, // zero value default\n\t\tConfigType: stack.AddressConfigStatic,  // zero value default\n\t}); err != nil {","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/service/service.go#L66-L102","documentation":"service.New creates a channel-backed NIC in the gVisor netstack via CreateNIC(nicID, linkEP); a non-nil tcpip error aborts startup with this message. Without the NIC there is no link endpoint to route tunneled packets through.","triggerScenarios":"service.New is called and CreateNIC fails — typically duplicate nicID registration on the same stack, or a gVisor version where channel.New/endpoint registration semantics changed.","commonSituations":"Calling New twice on the same shared ipstack with the same nicID; custom netstack assembly code reusing nicID; gVisor API mismatch after dependency upgrade.","solutions":["Ensure service.New creates its own fresh ipstack and uses the constant nicID only once","If reusing a stack, pick a unique nicID or call NIC removal/Disable first","Pin/upgrade the gVisor dependency to match the CreateNIC API this code expects","Log the wrapped tcpipProblem to identify the exact error (e.g. ErrDuplicateNIC)"],"exampleFix":"// before\ns.ipstack.CreateNIC(nicID, linkEP) // nicID already registered on this stack\n// after\ns.ipstack.RemoveNIC(nicID) // or use a fresh stack per service.New\ns.ipstack.CreateNIC(nicID, linkEP)","handlingStrategy":"try-catch","validationCode":"// ensure one NIC per stack:\n// create a fresh ipstack in service.New; do not share across instances","typeGuard":null,"tryCatchPattern":"svc, err := service.New(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"netstack NIC\") {\n        log.Fatalf(\"NIC creation failed (duplicate nicID or gVisor API change): %v\", err)\n    }\n    return err\n}","preventionTips":["Create one ipstack per service instance; never reuse nicID across New calls","Upgrade gVisor in lockstep with service code changes","Surface the wrapped tcpipProblem code in logs"],"tags":["netstack","gvisor","nic"],"backgroundTag":"netstack-configuration-error","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}