{"record":{"id":"e540c793c49fb4a5","repo":"hashicorp/nomad","slug":"panic-err-e540c7","errorCode":null,"errorMessage":"panic(err)","messagePattern":"panic\\(err\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_cni.go","lineNumber":145,"sourceCode":"\t\ttaskenv.AllocID:   alloc.ID,         // NOMAD_ALLOC_ID\n\t} {\n\t\t// job ID and group name may contain \";\" but CNI_ARGS are \";\"-separated\n\t\t// per the spec, so they may not be used in arg keys or values.\n\t\tif strings.Contains(value, \";\") {\n\t\t\tlogger.Warn(\"Skipping CNI arg because it contains a semicolon\",\n\t\t\t\t\"key\", key, \"value\", value)\n\t\t} else {\n\t\t\tcniArgs[key] = value\n\t\t}\n\t}\n}\n\nvar supportsCNICheck = mustCNICheckConstraint()\n\nfunc mustCNICheckConstraint() version.Constraints {\n\tv, err := version.NewConstraint(\">= 1.3.0\")\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\treturn v\n}\n\n// Setup calls the CNI plugins with the add action\nfunc (c *cniNetworkConfigurator) Setup(ctx context.Context, alloc *structs.Allocation, spec *drivers.NetworkIsolationSpec, created bool) (*structs.AllocNetworkStatus, error) {\n\n\tif err := c.ensureCNIInitialized(); err != nil {\n\t\treturn nil, fmt.Errorf(\"cni not initialized: %w\", err)\n\t}\n\tcniArgs := map[string]string{\n\t\t// CNI plugins are called one after the other with the same set of\n\t\t// arguments. Passing IgnoreUnknown=true signals to plugins that they\n\t\t// should ignore any arguments they don't understand\n\t\t\"IgnoreUnknown\": \"true\",\n\t}\n\n\ttg := alloc.Job.LookupTaskGroup(alloc.TaskGroup)","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_cni.go#L127-L163","documentation":"mustCNICheckConstraint parses the version constraint '>= 1.3.0' at package init to build the supportsCNICheck constraint used to decide whether the CNI check mode is available. It panics if version.NewConstraint returns an error; since the constraint string is a compile-time constant and valid, the panic is an unreachable invariant indicating the version-constraint library or build is broken, not user misconfiguration.","triggerScenarios":"Package initialization of client/allocrunner when version.NewConstraint(\">= 1.3.0\") errors — only possible with a broken/mismatched hashicorp/go-version dependency or an altered constraint string in a fork.","commonSituations":"Vendored go-version version drift or corruption; hand-edited constraint strings in forks that violate constraint grammar (e.g., '>= 1.3.0' typos like '>> 1.3.0'); never in stock builds.","solutions":["Restore the correct hashicorp/go-version dependency (go mod tidy / go mod verify)","If you edited the constraint string, fix its syntax per go-version grammar (e.g., '>= 1.3.0, < 2.0.0')","Rebuild from a clean checkout of the official release","Capture the panic error text — it names the invalid constraint — and correct it"],"exampleFix":"// before\nv, err := version.NewConstraint(\">= 1.3.0\")\nif err != nil {\n\tpanic(err)\n}\n// after\nv, err := version.NewConstraint(\">= 1.3.0\")\nif err != nil {\n\treturn nil, fmt.Errorf(\"invalid CNI check version constraint: %w\", err)\n}","handlingStrategy":"validation","validationCode":"// Validate version-constraint strings before they reach init-time parsing in forks/tools.\nc, err := version.NewConstraint(\">= 1.3.0\")\nif err != nil {\n\treturn fmt.Errorf(\"invalid constraint: %w\", err)\n}\n_ = c","typeGuard":null,"tryCatchPattern":"// Go: recover around package initialization in plugin/extension hosts\nfunc initNetworking() (err error) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\terr = fmt.Errorf(\"CNI constraint init panicked: %v\", r)\n\t\t}\n\t}()\n\t_ = supportsCNICheck\n\treturn nil\n}","preventionTips":["Do not hand-edit constraint strings; follow go-version grammar","Keep hashicorp/go-version pinned and verified","Rebuild cleanly if init-time panics appear after dependency updates","Add an init smoke test that references supportsCNICheck"],"tags":["cni","version-constraint","panic","initialization"],"backgroundTag":"invalid-version-constraint","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}