{"record":{"id":"e604ea704312e51b","repo":"valyala/fasthttp","slug":"cannot-create-listening-unblocked-socket-w","errorCode":null,"errorMessage":"cannot create listening unblocked socket: %w","messagePattern":"cannot create listening unblocked socket: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"tcplisten/socket_other.go","lineNumber":21,"sourceCode":"package tcplisten\n\nimport (\n\t\"fmt\"\n\n\t\"golang.org/x/sys/unix\"\n)\n\nfunc newSocketCloexec(domain, typ, proto int) (int, error) {\n\tfd, err := unix.Socket(domain, typ|unix.SOCK_NONBLOCK|unix.SOCK_CLOEXEC, proto)\n\tif err == nil {\n\t\treturn fd, nil\n\t}\n\n\tif err == unix.EPROTONOSUPPORT || err == unix.EINVAL {\n\t\treturn newSocketCloexecOld(domain, typ, proto)\n\t}\n\n\treturn -1, fmt.Errorf(\"cannot create listening unblocked socket: %w\", err)\n}\n","sourceCodeStart":3,"sourceCodeEnd":23,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/tcplisten/socket_other.go#L3-L23","documentation":"This is the terminal error in newSocketCloexec on non-z/OS platforms: unix.Socket with SOCK_NONBLOCK|SOCK_CLOEXEC failed with an errno other than EPROTONOSUPPORT or EINVAL (which would trigger the fallback to newSocketCloexecOld). The library cannot create the listening socket at all, so NewListener fails immediately.","triggerScenarios":"Any NewListener call where socket(domain, typ|SOCK_NONBLOCK|SOCK_CLOEXEC, proto) returns e.g. EPERM, EMFILE, ENFILE, EACCES, EAFNOSUPPORT, or EPROTOTYPE.","commonSituations":"File descriptor exhaustion under load (EMFILE/ENFILE); seccomp profiles (Docker/gVisor) blocking socket() flags with EPERM; wrong network family requested; restricted environments where the modern flags are rejected outright.","solutions":["Inspect the wrapped errno: EMFILE/ENFILE means raise RLIMIT_NOFILE or reduce fd usage","EPERM/operation-not-permitted in containers: adjust seccomp profile to allow socket2 with SOCK_NONBLOCK/SOCK_CLOEXEC","Verify the network string (\"tcp\", \"tcp4\", \"tcp6\") matches an available address family","Run on an updated kernel/Go version so the modern socket() path or fallback succeeds"],"exampleFix":"// before\nln, err := cfg.NewListener(\"tcp6\", \":8080\") // EAFNOSUPPORT if IPv6 disabled\n// after\nif hasIPv6() { // e.g. check /proc/sys/net/ipv6 or dial test\n    ln, err = cfg.NewListener(\"tcp6\", \":8080\")\n} else {\n    ln, err = cfg.NewListener(\"tcp4\", \":8080\")\n}","handlingStrategy":"retry","validationCode":"// precondition checks before NewListener\nfds, _ := syscall.Getrlimit(syscall.RLIMIT_NOFILE)\nif fds.Cur < 1024 { /* raise limit or reduce usage */ }\nif _, err := net.Dial(\"tcp\", \"127.0.0.1:1\"); err != nil {\n    if errno, ok := err.(*net.OpError); ok && strings.Contains(errno.Err.Error(), \"socket\") {\n        log.Fatal(\"socket() blocked by sandbox\")\n    }\n}","typeGuard":"null","tryCatchPattern":"ln, err := cfg.NewListener(network, addr)\nif err != nil {\n    if strings.Contains(err.Error(), \"cannot create listening unblocked socket\") {\n        var errno syscall.Errno\n        if errors.As(err, &errno) && (errno == syscall.EMFILE || errno == syscall.ENFILE) {\n            time.Sleep(backoff) // transient fd exhaustion: retry\n            ln, err = cfg.NewListener(network, addr)\n        }\n    }\n}","preventionTips":["Monitor and raise fd limits (RLIMIT_NOFILE) in production","Allow socket2 with SOCK_NONBLOCK/SOCK_CLOEXEC in container seccomp profiles","Validate the requested network family is available on the host","Fail fast with the wrapped errno logged for diagnosability"],"tags":["network","sockets","syscall","fd-limit"],"backgroundTag":"socket-creation-failed","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}