What causes "opening netns pinned at %s: %w" in cilium/cilium?

Verify the container sandbox is still alive and the netns path in args.Netns exists on the node.

opening netns pinned at %s: %w

Error message

opening netns pinned at %s: %w

What it means

Cmd.Add failed while opening the pinned network namespace referenced by args.Netns via netns.OpenPinned. The CNI runtime passes a path (typically /proc/<pid>/ns/net or a named netns path) and the plugin must attach to that namespace; a missing, stale, or inaccessible path fails here.

Source

Thrown at plugins/cilium-cni/cmd/cmd.go:641

				return err
			}
			scopedLogger.Debug("Returning result", logfields.Result, res)
			return cniTypes.PrintResult(res, n.CNIVersion)
		} else if err != nil {
			scopedLogger.Error("Invalid chaining mode", logfields.Error, err)
			return err
		} else {
			// no chained action supplied; this is an error
			const errMsg = "CNI PrevResult supplied, but not in chaining mode -- this is invalid, please set chaining-mode in CNI configuration"
			scopedLogger.Error(errMsg)
			return errors.New(errMsg)
		}
	}

	res := &cniTypesV1.Result{}
	ns, err := netns.OpenPinned(args.Netns)
	if err != nil {
		return fmt.Errorf("opening netns pinned at %s: %w", args.Netns, err)
	}
	defer ns.Close()

	sysctl := sysctl.NewDirectSysctl(afero.NewOsFs(), "/proc")

	if err = ns.Do(func() error {
		return link.DeleteByName(args.IfName)
	}); err != nil {
		return fmt.Errorf("failed removing interface %q from namespace %q: %w",
			args.IfName, args.Netns, err)
	}

	var ipam *models.IPAMResponse
	var releaseIPsFunc func(context.Context)
	if conf.IpamMode == ipamOption.IPAMDelegatedPlugin {
		ipam, releaseIPsFunc, err = allocateIPsWithDelegatedPlugin(context.TODO(), conf, n, args.StdinData)
	} else {
		ipam, releaseIPsFunc, err = allocateIPsWithCiliumAgent(scopedLogger, c, cniArgs)

View on GitHub (pinned to ac7b90affa)

Solutions

Verify the container sandbox is still alive and the netns path in args.Netns exists on the node.
Ensure the CNI plugin runs as root with CAP_SYS_ADMIN/CAP_NET_ADMIN (check plugin exec permissions in the conflist).
Retry the pod; if the container exited during ADD, the runtime should re-invoke with a fresh namespace.
Check for stale CNI state and clean up: remove orphaned interfaces and let the runtime re-create the sandbox.
Confirm /proc is mounted and accessible in the plugin's mount namespace.

Example fix

// before: plugin invoked without privileges
"type": "cilium-cni"  // running as non-root user
// after
"type": "cilium-cni"  // with runtime guaranteeing root + CAP_NET_ADMIN, e.g. correct plugin dir perms

Defensive patterns

Strategy: validation

Validate before calling

// Verify netns path exists before ADD
if _, err := os.Stat(args.Netns); err != nil {
  return fmt.Errorf("netns %s unavailable: %w", args.Netns, err)
}

Try / catch

err := plugin.Add(args)
if err != nil && strings.Contains(err.Error(), "opening netns pinned at") {
  // container likely exited; verify sandbox and let runtime retry with a fresh netns
}

Prevention

Ensure the CNI plugin runs as root with CAP_SYS_ADMIN/CAP_NET_ADMIN
Avoid deleting sandboxes concurrently with ADD invocations
Keep /proc mounted and accessible on the node
Clean stale netns handles after sandbox recreation

When it happens

Trigger: netns.OpenPinned(args.Netns) errors because the netns path does not exist, the sandbox/container already exited, permissions are insufficient, or the path is not a valid network namespace.

Common situations: Race where the container terminates before ADD completes; stale netns handle after sandbox recreation; kubelet/CRI invoking plugin with an already-deleted namespace path; host missing /proc or running without sufficient privileges (non-root plugin execution).

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/e7da0c753e169bf4. Report an issue: GitHub.