{"record":{"id":"f10654cb2aafec55","repo":"lima-vm/lima","slug":"failed-to-open-netlink-connection-w","errorCode":null,"errorMessage":"failed to open netlink connection: %w","messagePattern":"failed to open netlink connection: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/sockets/sockets_linux.go","lineNumber":103,"sourceCode":"\t\tif family == unix.AF_INET6 {\n\t\t\tpname += \"6\"\n\t\t}\n\n\t\tnewSocket := Socket{\n\t\t\tKind:  pname,\n\t\t\tIP:    localIP,\n\t\t\tPort:  sport,\n\t\t\tState: state,\n\t\t}\n\t\tsockets = append(sockets, newSocket)\n\t}\n\treturn sockets, nil\n}\n\nfunc NewLister() (*Lister, error) {\n\tconn, err := netlink.Dial(unix.NETLINK_SOCK_DIAG, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to open netlink connection: %w\", err)\n\t}\n\treturn &Lister{conn: conn}, nil\n}\n\ntype Lister struct {\n\tconn *netlink.Conn\n}\n\nfunc (lister *Lister) List() ([]Socket, error) {\n\tprotos := []int{unix.IPPROTO_TCP, unix.IPPROTO_UDP}\n\tfamilies := []int{unix.AF_INET, unix.AF_INET6}\n\n\tvar sockets []Socket\n\tfor _, proto := range protos {\n\t\tfor _, fam := range families {\n\t\t\tmsgs, err := query(lister.conn, fam, proto)\n\t\t\tif err != nil {\n\t\t\t\tcontinue","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/sockets/sockets_linux.go#L85-L121","documentation":"NewLister dials the NETLINK_SOCK_DIAG family to enumerate TCP/UDP sockets via inet_diag. If the netlink socket cannot be created (permission denied, protocol family unavailable, seccomp/AppArmor restriction), the dial error is wrapped with this message.","triggerScenarios":"NewLister (invoked via New, or TestListS_Integration) when netlink.Dial(unix.NETLINK_SOCK_DIAG, nil) fails — kernel without SOCK_DIAG support, sandbox blocking netlink, or resource exhaustion.","commonSituations":"Running inside a container/sandbox that filters netlink sockets; hardened seccomp profile in the guest agent context; very old kernel lacking inet_diag; running tests in restricted CI environments.","solutions":["Check the wrapped cause: EPROTONOSUPPORT means the kernel lacks SOCK_DIAG; EPERM means a security module blocks it.","Run outside of restrictive sandboxes or update the seccomp/AppArmor profile to allow AF_NETLINK SOCK_DIAG.","Ensure a reasonably modern Linux kernel (inet_diag has long been standard).","Retry on transient resource errors (EMFILE/ENFILE — raise fd limits)."],"exampleFix":"// before: no fallback\ntl, err := sockets.New()\n// after: degrade gracefully\ntl, err := sockets.New()\nif err != nil {\n\tlogrus.WithError(err).Warn(\"netlink sock-diag unavailable; port detection disabled\")\n}","handlingStrategy":"fallback","validationCode":"// pre-check that sock diag netlink is available\nconn, err := netlink.Dial(unix.NETLINK_SOCK_DIAG, nil)\nif err != nil { /* port detection unavailable */ }\nconn.Close()","typeGuard":null,"tryCatchPattern":"lister, err := sockets.NewLister()\nif err != nil {\n\tlog.WithError(err).Warn(\"netlink sock-diag unavailable; falling back to no port detection\")\n\tlister = nil\n}","preventionTips":["Test sock-diag availability once at agent startup and degrade gracefully.","Keep seccomp/AppArmor profiles permissive for AF_NETLINK SOCK_DIAG.","Raise fd limits if EMFILE/ENFILE appears in the wrapped error.","Run integration tests in environments mirroring production sandboxing."],"tags":["guestagent","netlink","linux","sockets"],"backgroundTag":"netlink-dial-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}