{"record":{"id":"f05bc5d974365a2e","repo":"k3s-io/k3s","slug":"host-identifier-bits-must-not-be-set-in-cidr-prefi","errorCode":null,"errorMessage":"host identifier bits must not be set in CIDR prefix","messagePattern":"host identifier bits must not be set in CIDR prefix","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless.go","lineNumber":128,"sourceCode":"func readSysctl(key string) (string, error) {\n\tp := \"/proc/sys/\" + strings.ReplaceAll(key, \".\", \"/\")\n\tb, err := os.ReadFile(p)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn strings.TrimSpace(string(b)), nil\n}\n\nfunc parseCIDR(s string) (*net.IPNet, error) {\n\tif s == \"\" {\n\t\treturn nil, nil\n\t}\n\tip, ipnet, err := net.ParseCIDR(s)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !ip.Equal(ipnet.IP) {\n\t\treturn nil, errors.New(\"host identifier bits must not be set in CIDR prefix\")\n\t}\n\treturn ipnet, nil\n}\n\nfunc createParentOpt(driver portDriver, stateDir string, enableIPv6 bool) (*parent.Opt, error) {\n\tif err := os.MkdirAll(stateDir, 0755); err != nil {\n\t\treturn nil, errors.WithMessagef(err, \"failed to mkdir %s\", stateDir)\n\t}\n\n\tdriver.SetStateDir(stateDir)\n\n\topt := &parent.Opt{\n\t\tStateDir:       stateDir,\n\t\tCreatePIDNS:    true,\n\t\tCreateCgroupNS: true,\n\t\tCreateUTSNS:    true,\n\t\tCreateIPCNS:    true,\n\t}","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/rootless/rootless.go#L110-L146","documentation":"parseCIDR parses a CIDR with net.ParseCIDR and requires the parsed IP to equal the network address of the enclosing net.IPNet (ip.Equal(ipnet.IP)). Any prefix with host bits set - e.g. 10.0.0.5/16 instead of 10.0.0.0/16 - is rejected so downstream address allocation gets a clean base network.","triggerScenarios":"Configuring rootless networking options that accept CIDRs (service/bridge CIDRs) with a host-portion-bearing address; passing an address like fd00::1/64 where fd00::/64 is required.","commonSituations":"Operators writing the gateway/node IP instead of the network address; copy-pasting pod CIDRs from another system that allows host bits; IPv6 configs where the interface identifier is left in.","solutions":["Change the CIDR to its base network: 10.42.0.5/24 -> 10.42.0.0/24, fd00::1/64 -> fd00::/64.","Compute it if generated programmatically: ip, ipnet, _ := net.ParseCIDR(s); use ipnet.String().","Validate with 'ipcalc' or equivalent before deploying."],"exampleFix":"// before\nsubnet := \"192.168.5.1/24\" // host bits set -> error\n// after\nsubnet := \"192.168.5.0/24\"","handlingStrategy":"validation","validationCode":"func isBaseCIDR(s string) bool {\n\tip, ipnet, err := net.ParseCIDR(s)\n\tif err != nil {\n\t\treturn false\n\t}\n\treturn ip.Equal(ipnet.IP)\n}\n\n// normalize instead of rejecting:\nip, ipnet, err := net.ParseCIDR(s)\nif err == nil {\n    s = ipnet.String() // 10.0.0.5/16 -> 10.0.0.0/16\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write CIDRs as network addresses in config files.","When generating CIDRs, emit ipnet.String() rather than the original input."],"tags":["networking","cidr","configuration","rootless"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}