{"record":{"id":"ff28ef7f3bdc7777","repo":"hashicorp/nomad","slug":"failed-to-list-iptables-chains-v","errorCode":null,"errorMessage":"failed to list iptables chains: %v","messagePattern":"failed to list iptables chains: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/networking_iptables.go","lineNumber":71,"sourceCode":"\n// ensureChainRule ensures our admin chain exists and contains a rule to accept\n// traffic to the bridge network\nfunc ensureChainRule(ipt IPTablesChain, bridgeName, subnet string) error {\n\tif err := ensureChain(ipt, \"filter\", cniAdminChainName); err != nil {\n\t\treturn err\n\t}\n\trule := generateAdminChainRule(bridgeName, subnet)\n\tif err := appendChainRule(ipt, cniAdminChainName, rule); err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\n// ensureChain ensures that the given chain exists, creating it if missing\nfunc ensureChain(ipt IPTablesChain, table, chain string) error {\n\tchains, err := ipt.ListChains(table)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to list iptables chains: %v\", err)\n\t}\n\tif slices.Contains(chains, chain) {\n\t\treturn nil\n\t}\n\n\terr = ipt.NewChain(table, chain)\n\n\t// if err is for chain already existing return as it is possible another\n\t// goroutine created it first\n\tif e, ok := err.(*iptables.Error); ok && e.ExitStatus() == 1 {\n\t\treturn nil\n\t}\n\n\treturn err\n}\n\n// appendChainRule adds the given rule to the chain\nfunc appendChainRule(ipt IPTablesChain, chain string, rule []string) error {","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/networking_iptables.go#L53-L89","documentation":"ensureChain called ipt.ListChains to check whether the Nomad admin chain exists and the listing operation failed (iptables missing, permission denied, or netfilter error), so admin chain setup for bridge networking cannot proceed.","triggerScenarios":"Thrown at client/allocrunner/networking_iptables.go:71 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure iptables is installed and executable by the Nomad client","Verify root/CAP_NET_ADMIN capability for iptables operations","Check kernel netfilter module availability (modprobe ip_tables)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}