{"record":{"id":"ef485dc9e8bcde3d","repo":"cilium/cilium","slug":"failed-to-open-pinned-netns-at-s-w","errorCode":null,"errorMessage":"failed to open pinned netns at %s: %w","messagePattern":"failed to open pinned netns at (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/networkdriver/nri.go","lineNumber":139,"sourceCode":"\t\tif networkNamespace == \"\" {\n\t\t\tlog.DebugContext(ctx, \"RunPodSandbox pod using host network cannot claim host devices\")\n\t\t\treturn nil\n\t\t}\n\n\t\tlog = log.With(logfields.NetNamespace, networkNamespace)\n\n\t\t// Collect all allocations for this pod from the statedb table.\n\t\tpodAllocations := driver.allocationsForPod(kube_types.UID(podSandbox.Uid))\n\t\tif len(podAllocations) == 0 {\n\t\t\tlog.DebugContext(ctx, \"no allocation found\")\n\t\t\treturn nil\n\t\t}\n\n\t\tnsPath := path.Join(podNetNSPath, path.Base(networkNamespace))\n\n\t\tpodNs, err := netns.OpenPinned(nsPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to open pinned netns at %s: %w\", nsPath, err)\n\t\t}\n\n\t\tdefer podNs.Close()\n\n\t\t// Check for interface name collisions with existing interfaces in pod netns\n\t\tif err := podNs.Do(func() error {\n\t\t\tif err := validateInterfaceNames(podAllocations); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\treturn nil\n\t\t}); err != nil {\n\t\t\treturn fmt.Errorf(\"pod interface allocations is invalid: %w\", err)\n\t\t}\n\n\t\tfor _, a := range podAllocations {\n\t\t\tl, err := safenetlink.LinkByName(a.Device.KernelIfName())\n\t\t\tif err != nil {","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/networkdriver/nri.go#L121-L157","documentation":"RunPodSandbox failed to open the pod's pinned network namespace at the computed path (<podNetNSPath>/<basename of the pod's netns path>) using netns.OpenPinned. Without an fd to the pod netns, allocated devices cannot be validated or moved into the pod, so the sandbox setup fails. The wrapped cause is the underlying open error (ENOENT, EACCES, etc.).","triggerScenarios":"netns.OpenPinned(nsPath) fails during RunPodSandbox: the pinned netns file does not exist (pod exited / netns reaped before the event), the path is wrong, or the process lacks permission to open /proc-style ns handles.","commonSituations":"Sandbox terminated between the runtime event and this call; node reboot reaped the netns while allocations persisted; containerd < 2.1 delivering a stale cached namespace path; agent running without access to the host's /var/run/netns.","solutions":["Verify the pod sandbox is still alive; if the sandbox is gone the event is stale and can be ignored.","Check that podNetNSPath (defaults.NetNsPath, /var/run/netns) is mounted in the agent container.","Confirm the cached/derived namespace path still exists (ls -l /var/run/netns).","Restore host access/privileges so the agent can open namespace files.","Retry on the next event — allocation state is idempotent and re-created on demand."],"exampleFix":"// before: hostPath not mounted\n# no volume for /var/run/netns\n// after: mount the host netns directory into the agent\nvolumeMounts:\n  - name: netns\n    mountPath: /var/run/netns\n    readOnly: true\nvolumes:\n  - name: netns\n    hostPath: { path: /var/run/netns }","handlingStrategy":"try-catch","validationCode":"// Check the pinned netns file exists before opening it\nif _, err := os.Stat(nsPath); err != nil {\n    return fmt.Errorf(\"pod netns %s unavailable (sandbox gone or not mounted): %w\", nsPath, err)\n}","typeGuard":null,"tryCatchPattern":"podNs, err := netns.OpenPinned(nsPath)\nif err != nil {\n    if errors.Is(err, fs.ErrNotExist) {\n        log.Info(\"pod netns already reaped; skipping sandbox setup\")\n        return nil\n    }\n    return fmt.Errorf(\"failed to open pinned netns at %s: %w\", nsPath, err)\n}\ndefer podNs.Close()","preventionTips":["Mount /var/run/netns (hostPath) read-only into the agent pod.","Verify the sandbox is alive before processing its events.","Treat ENOENT as a stale event and skip rather than fail.","Keep host privileges so namespace files can be opened.","After node reboots, expect the on-demand device re-creation path to handle missing links."],"tags":["network","netns","cilium","containers"],"backgroundTag":"netns-open-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}