{"record":{"id":"e7da0c753e169bf4","repo":"cilium/cilium","slug":"opening-netns-pinned-at-s-w","errorCode":null,"errorMessage":"opening netns pinned at %s: %w","messagePattern":"opening netns pinned at (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/cilium-cni/cmd/cmd.go","lineNumber":641,"sourceCode":"\t\t\t\treturn err\n\t\t\t}\n\t\t\tscopedLogger.Debug(\"Returning result\", logfields.Result, res)\n\t\t\treturn cniTypes.PrintResult(res, n.CNIVersion)\n\t\t} else if err != nil {\n\t\t\tscopedLogger.Error(\"Invalid chaining mode\", logfields.Error, err)\n\t\t\treturn err\n\t\t} else {\n\t\t\t// no chained action supplied; this is an error\n\t\t\tconst errMsg = \"CNI PrevResult supplied, but not in chaining mode -- this is invalid, please set chaining-mode in CNI configuration\"\n\t\t\tscopedLogger.Error(errMsg)\n\t\t\treturn errors.New(errMsg)\n\t\t}\n\t}\n\n\tres := &cniTypesV1.Result{}\n\tns, err := netns.OpenPinned(args.Netns)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"opening netns pinned at %s: %w\", args.Netns, err)\n\t}\n\tdefer ns.Close()\n\n\tsysctl := sysctl.NewDirectSysctl(afero.NewOsFs(), \"/proc\")\n\n\tif err = ns.Do(func() error {\n\t\treturn link.DeleteByName(args.IfName)\n\t}); err != nil {\n\t\treturn fmt.Errorf(\"failed removing interface %q from namespace %q: %w\",\n\t\t\targs.IfName, args.Netns, err)\n\t}\n\n\tvar ipam *models.IPAMResponse\n\tvar releaseIPsFunc func(context.Context)\n\tif conf.IpamMode == ipamOption.IPAMDelegatedPlugin {\n\t\tipam, releaseIPsFunc, err = allocateIPsWithDelegatedPlugin(context.TODO(), conf, n, args.StdinData)\n\t} else {\n\t\tipam, releaseIPsFunc, err = allocateIPsWithCiliumAgent(scopedLogger, c, cniArgs)","sourceCodeStart":623,"sourceCodeEnd":659,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/plugins/cilium-cni/cmd/cmd.go#L623-L659","documentation":"Cmd.Add failed while opening the pinned network namespace referenced by args.Netns via netns.OpenPinned. The CNI runtime passes a path (typically /proc/<pid>/ns/net or a named netns path) and the plugin must attach to that namespace; a missing, stale, or inaccessible path fails here.","triggerScenarios":"netns.OpenPinned(args.Netns) errors because the netns path does not exist, the sandbox/container already exited, permissions are insufficient, or the path is not a valid network namespace.","commonSituations":"Race where the container terminates before ADD completes; stale netns handle after sandbox recreation; kubelet/CRI invoking plugin with an already-deleted namespace path; host missing /proc or running without sufficient privileges (non-root plugin execution).","solutions":["Verify the container sandbox is still alive and the netns path in args.Netns exists on the node.","Ensure the CNI plugin runs as root with CAP_SYS_ADMIN/CAP_NET_ADMIN (check plugin exec permissions in the conflist).","Retry the pod; if the container exited during ADD, the runtime should re-invoke with a fresh namespace.","Check for stale CNI state and clean up: remove orphaned interfaces and let the runtime re-create the sandbox.","Confirm /proc is mounted and accessible in the plugin's mount namespace."],"exampleFix":"// before: plugin invoked without privileges\n\"type\": \"cilium-cni\"  // running as non-root user\n// after\n\"type\": \"cilium-cni\"  // with runtime guaranteeing root + CAP_NET_ADMIN, e.g. correct plugin dir perms","handlingStrategy":"validation","validationCode":"// Verify netns path exists before ADD\nif _, err := os.Stat(args.Netns); err != nil {\n  return fmt.Errorf(\"netns %s unavailable: %w\", args.Netns, err)\n}","typeGuard":null,"tryCatchPattern":"err := plugin.Add(args)\nif err != nil && strings.Contains(err.Error(), \"opening netns pinned at\") {\n  // container likely exited; verify sandbox and let runtime retry with a fresh netns\n}","preventionTips":["Ensure the CNI plugin runs as root with CAP_SYS_ADMIN/CAP_NET_ADMIN","Avoid deleting sandboxes concurrently with ADD invocations","Keep /proc mounted and accessible on the node","Clean stale netns handles after sandbox recreation"],"tags":["network","netns","cni"],"backgroundTag":"netns-open-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}