cilium/cilium · error

Unable get time: %w

Error message

Unable get time: %w

What it means

GetMtime returns a high-resolution monotonic timestamp via clock_gettime(CLOCK_MONOTONIC). This error is wrapped when the ClockGettime syscall fails. On Linux this essentially never fails in normal operation, so seeing it indicates a severely restricted environment (seccomp filter, broken vDSO/syscall allowlist) or an exotic platform.

Source

Thrown at pkg/bpf/bpf_linux.go:135

		}

		return createMap(spec, &opts)
	}

	return m, err
}

// GetMtime returns monotonic time that can be used to compare
// values with ktime_get_ns() BPF helper, e.g. needed to check
// the timeout in sec for BPF entries. We return the raw nsec,
// although that is not quite usable for comparison. Go has
// runtime.nanotime() but doesn't expose it as API.
func GetMtime() (uint64, error) {
	var ts unix.Timespec

	err := unix.ClockGettime(unix.CLOCK_MONOTONIC, &ts)
	if err != nil {
		return 0, fmt.Errorf("Unable get time: %w", err)
	}

	return uint64(unix.TimespecToNsec(ts)), nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the wrapped errno to identify the failing cause
2. Relax the seccomp/container profile to permit clock_gettime(CLOCK_MONOTONIC)
3. Test on the host with `docker run --rm alpine date` inside the same sandbox to confirm syscall availability
4. Update the container runtime (gVisor etc.) to a version supporting CLOCK_MONOTONIC

mtime, err := bpf.GetMtime()
if err != nil {
    // CLOCK_MONOTONIC unavailable (seccomp/sandbox); fail fast or use fallback source
    return fmt.Errorf("monotonic clock unavailable: %w", err)
}

When it happens

Trigger: unix.ClockGettime(CLOCK_MONOTONIC) returns an error: seccomp/containersandbox blocking clock_gettime, unsupported platform build, or gVisor-like runtimes lacking the syscall.

Common situations: Tight container seccomp profiles that don't allow clock_gettime; gVisor/Kata runtimes with incomplete syscall emulation; porting the code to non-Linux unix-like systems.

Related errors

• Require support for bpf() (CONFIG_BPF_SYSCALL=y)
• NameToHandleAt failed: %w
• handle returned by NameToHandleAt is too small (%v bytes)
• cannot get xfrm state: %w
• error getting xfrm stats: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4aa800285298467c. Report an issue: GitHub.