cilium/cilium · error

failed to setsockopt(SO_REUSEPORT): %w

Error message

failed to setsockopt(SO_REUSEPORT): %w

What it means

Companion to the SO_REUSEADDR case: setsockoptReuseAddrAndPort also sets SO_REUSEPORT so the agent can re-bind the same port after restarts (useful when kube-proxy or the previous agent instance still holds it). Failure of unix.SetsockoptInt(SOL_SOCKET, SO_REUSEPORT, 1) is wrapped into this error and fails listener setup.

Source

Thrown at daemon/healthz/sockopt.go:30

// setsockoptReuseAddrAndPort sets the SO_REUSEADDR and SO_REUSEPORT socket options on c's
// underlying socket in order to improve the chance to re-bind to the same address and port
// upon restart.
func setsockoptReuseAddrAndPort(network, address string, c syscall.RawConn) error {
	var soerr error
	if err := c.Control(func(su uintptr) {
		s := int(su)
		// Allow reuse of recently-used addresses. This socket option is
		// set by default on listeners in Go's net package, see
		// net setDefaultListenerSockopts
		if err := unix.SetsockoptInt(s, unix.SOL_SOCKET, unix.SO_REUSEADDR, 1); err != nil {
			soerr = fmt.Errorf("failed to setsockopt(SO_REUSEADDR): %w", err)
			return
		}
		// Allow reuse of recently-used ports. This gives the agent a
		// better chance to re-bind upon restarts.
		if err := unix.SetsockoptInt(s, unix.SOL_SOCKET, unix.SO_REUSEPORT, 1); err != nil {
			soerr = fmt.Errorf("failed to setsockopt(SO_REUSEPORT): %w", err)
		}
	}); err != nil {
		return err
	}
	return soerr
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Allow setsockopt(SOL_SOCKET, SO_REUSEPORT) in the seccomp/LSM profile for the cilium agent
2. Verify kernel version supports SO_REUSEPORT (>=3.9) and the runtime honors it
3. As a workaround, drop the SO_REUSEPORT call and instead ensure the port is free before start (stop conflicting kube-proxy)
4. Report the runtime/kernel combination if options are systematically unsupported

// verify kernel support before relying on SO_REUSEPORT
if !kernelSupportsReusePort() { // e.g. parse uname -r >= 3.9 and test setsockopt
	log.Warn("SO_REUSEPORT unsupported; ensure the port is free before start")
}

if err := setsockoptReuseAddrAndPort(nil, "tcp", nil); err != nil {
	if errors.Is(err, unix.ENOPROTOOPT) || errors.Is(err, unix.EPERM) {
		log.WithError(err).Warn("SO_REUSEPORT unavailable; falling back")
	}
}

When it happens

Trigger: The Control callback runs during Listen and SetsockoptInt for SO_REUSEPORT returns an error — typically denied by seccomp/LSM or an unsupported kernel/platform combination.

Common situations: Hardened seccomp profiles blocking SO_REUSEPORT; very old kernels lacking SO_REUSEPORT semantics; sandboxed runtimes (gVisor/kata) with incomplete socket-option support.

Related errors

• failed to setsockopt(SO_REUSEADDR): %w
• setsockopt(SO_REUSEPORT) failed: %w
• no message nor error from netlink
• no client TLS config is set
• no server TLS config is set

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/e605f4906053dfc3. Report an issue: GitHub.