cloudflare/cloudflared · error

failed to get own start time: %w

Error message

failed to get own start time: %w

What it means

newSelfLockContent wraps p.CreateTime() from go-sysconf/shirou-gopsutil when it fails to read the current process's start time (process creation time). This value is used to fingerprint the lock file so a recycled PID can be detected. The library throws this because a lock file without a reliable start time cannot distinguish a live holder from a recycled PID, so acquiring the lock is aborted instead of writing a misleading file.

Source

Thrown at token/token.go:256

	}

	if err := json.NewEncoder(f).Encode(content); err != nil {
		return lockContent{}, err
	}

	return content, nil
}

// newSelfLockContent returns a lockContent describing the current process.
func newSelfLockContent() (lockContent, error) {
	pid := int32(os.Getpid()) // nolint: gosec
	p, err := process.NewProcess(pid)
	if err != nil {
		return lockContent{}, fmt.Errorf("failed to look up own process: %w", err)
	}
	ct, err := p.CreateTime()
	if err != nil {
		return lockContent{}, fmt.Errorf("failed to get own start time: %w", err)
	}
	id, err := newLockID()
	if err != nil {
		return lockContent{}, err
	}
	return lockContent{PID: pid, StartTime: ct, ID: id}, nil
}

func newLockID() (string, error) {
	var b [16]byte
	if _, err := rand.Read(b[:]); err != nil {
		return "", fmt.Errorf("failed to generate lock ID: %w", err)
	}
	return hex.EncodeToString(b[:]), nil
}

// isLockFileStale reads the lock file and checks whether the owning process
// is dead or has a mismatched start time. Returns (true, content, nil) if

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Inspect the wrapped %w error (e.g. mount /proc with psutil-visible stat files: ensure /proc is mounted with default options inside the container).
2. Check container security policies (Docker --security-opt seccomp=..., AppArmor/SELinux profiles) that deny stat access to /proc/self and relax them.
3. Verify the platform is one where gopsutil supports CreateTime (Linux reads /proc/<pid>/stat which is world-readable; macOS/Windows may need same-user).
4. Update the gopsutil dependency; older versions fail on newer kernels' /proc formats.
5. As a last resort remove a stale lock file manually once the process holding it is confirmed dead.

Example fix

// before: failing inside a restricted container
content, err := newSelfLockContent()
// after: verify /proc is usable before acquiring the lock
if _, err := os.Stat(fmt.Sprintf("/proc/%d/stat", os.Getpid())); err != nil {
    log.Fatal().Err(err).Msg("/proc unavailable; cannot create lock file")
}
content, err := newSelfLockContent()

if _, err := os.Stat(fmt.Sprintf("/proc/%d/stat", os.Getpid())); err != nil {
    // /proc stat unavailable; lock acquisition will fail
}

func canReadOwnCreateTime() bool {
    p, err := process.NewProcess(int32(os.Getpid()))
    return err == nil && func() bool { _, err := p.CreateTime(); return err == nil }()
}

content, err := createLockFile(path)
if err != nil {
    if strings.Contains(err.Error(), "failed to get own start time") {
        // fall back: warn and run without lock, or abort with guidance
        log.Warn().Err(err).Msg("cannot fingerprint process start time; check /proc access")
    }
    return err
}

When it happens

Trigger: Calling createLockFile (via the token/lock acquisition path) when process.NewProcess(os.Getpid()) succeeds but p.CreateTime() fails — e.g. /proc/<pid>/stat unreadable on Linux, restricted /proc mounts in hardened containers, or gopsutil platform failures on unusual OS/kernel combinations.

Common situations: Running cloudflared in a container with a masked or read-only /proc, seccomp/AppArmor policies blocking /proc stat reads, degraded procfs on heavily loaded systems, or running on an unsupported/glibc-less platform where gopsutil's CreateTime implementation fails.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• error creating %s: %v
• error writing %s: %v
• error deleting %s: %v
• error getting stderr pipe: %v
• error opening file %s:%w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/32c64cbdd7f64bb5. Report an issue: GitHub.