cilium/cilium · error

failed to open pinned netns at %s: %w

Error message

failed to open pinned netns at %s: %w

What it means

RunPodSandbox failed to open the pod's pinned network namespace at the computed path (<podNetNSPath>/<basename of the pod's netns path>) using netns.OpenPinned. Without an fd to the pod netns, allocated devices cannot be validated or moved into the pod, so the sandbox setup fails. The wrapped cause is the underlying open error (ENOENT, EACCES, etc.).

Source

Thrown at pkg/networkdriver/nri.go:139

		if networkNamespace == "" {
			log.DebugContext(ctx, "RunPodSandbox pod using host network cannot claim host devices")
			return nil
		}

		log = log.With(logfields.NetNamespace, networkNamespace)

		// Collect all allocations for this pod from the statedb table.
		podAllocations := driver.allocationsForPod(kube_types.UID(podSandbox.Uid))
		if len(podAllocations) == 0 {
			log.DebugContext(ctx, "no allocation found")
			return nil
		}

		nsPath := path.Join(podNetNSPath, path.Base(networkNamespace))

		podNs, err := netns.OpenPinned(nsPath)
		if err != nil {
			return fmt.Errorf("failed to open pinned netns at %s: %w", nsPath, err)
		}

		defer podNs.Close()

		// Check for interface name collisions with existing interfaces in pod netns
		if err := podNs.Do(func() error {
			if err := validateInterfaceNames(podAllocations); err != nil {
				return err
			}

			return nil
		}); err != nil {
			return fmt.Errorf("pod interface allocations is invalid: %w", err)
		}

		for _, a := range podAllocations {
			l, err := safenetlink.LinkByName(a.Device.KernelIfName())
			if err != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the pod sandbox is still alive; if the sandbox is gone the event is stale and can be ignored.
2. Check that podNetNSPath (defaults.NetNsPath, /var/run/netns) is mounted in the agent container.
3. Confirm the cached/derived namespace path still exists (ls -l /var/run/netns).
4. Restore host access/privileges so the agent can open namespace files.
5. Retry on the next event — allocation state is idempotent and re-created on demand.

Example fix

// before: hostPath not mounted
# no volume for /var/run/netns
// after: mount the host netns directory into the agent
volumeMounts:
  - name: netns
    mountPath: /var/run/netns
    readOnly: true
volumes:
  - name: netns
    hostPath: { path: /var/run/netns }

// Check the pinned netns file exists before opening it
if _, err := os.Stat(nsPath); err != nil {
    return fmt.Errorf("pod netns %s unavailable (sandbox gone or not mounted): %w", nsPath, err)
}

podNs, err := netns.OpenPinned(nsPath)
if err != nil {
    if errors.Is(err, fs.ErrNotExist) {
        log.Info("pod netns already reaped; skipping sandbox setup")
        return nil
    }
    return fmt.Errorf("failed to open pinned netns at %s: %w", nsPath, err)
}
defer podNs.Close()

When it happens

Trigger: netns.OpenPinned(nsPath) fails during RunPodSandbox: the pinned netns file does not exist (pod exited / netns reaped before the event), the path is wrong, or the process lacks permission to open /proc-style ns handles.

Common situations: Sandbox terminated between the runtime event and this call; node reboot reaped the netns while allocations persisted; containerd < 2.1 delivering a stale cached namespace path; agent running without access to the host's /var/run/netns.

Related errors

• invalid endpoint %q, must be IP:PORT: %w
• invalid port %q: %w
• port mismatch (%d != %d), all endpoints must use the same po
• failed to port forward: %w
• failed to retrieve metrics: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/ef485dc9e8bcde3d. Report an issue: GitHub.