dagger/dagger · error

listen for nested client: %w

Error message

listen for nested client: %w

What it means

For execs hosting a nested Dagger client, setup runs net.Listen("tcp", "127.0.0.1:0") inside the container's network namespace via runInNetNS. If listening fails (namespace entry failure, socket errors, resource limits), setup fails with 'listen for nested client'.

Source

Thrown at engine/engineutil/executor_spec.go:1113

		}
	}

	// include overridden client version if it's set in the exec's env vars
	if version, ok := state.origEnvMap["_EXPERIMENTAL_DAGGER_VERSION"]; ok {
		state.nestedClientMetadata.ClientVersion = version
	}

	srvCtx, srvCancel := context.WithCancelCause(ctx)
	state.cleanups.Add("cancel session server", cleanups.Infallible(func() {
		srvCancel(errors.New("container cleanup"))
	}))
	srvPool := pool.New().WithContext(srvCtx).WithCancelOnError()

	httpListener, err := runInNetNS(ctx, state, func() (net.Listener, error) {
		return net.Listen("tcp", "127.0.0.1:0")
	})
	if err != nil {
		return fmt.Errorf("listen for nested client: %w", err)
	}
	state.cleanups.Add("close nested client listener", cleanups.IgnoreErrs(httpListener.Close, net.ErrClosed))

	tcpAddr, ok := httpListener.Addr().(*net.TCPAddr)
	if !ok {
		return fmt.Errorf("unexpected listener address type: %T", httpListener.Addr())
	}
	state.spec.Process.Env = append(state.spec.Process.Env, DaggerSessionPortEnv+"="+strconv.Itoa(tcpAddr.Port))
	state.spec.Process.Env = append(state.spec.Process.Env, DaggerEngineNumCPUEnv+"="+strconv.Itoa(runtime.NumCPU()))

	protocols := new(http.Protocols)
	protocols.SetHTTP1(true)
	protocols.SetUnencryptedHTTP2(true)
	httpSrv := &http.Server{
		// NOTE: no ReadHeaderTimeout (gosec G112) — see cmd/engine/main.go. On
		// Go >= 1.26.6 it becomes a hard lifetime cap on unencrypted HTTP/2
		// connections, which would kill every module function call that runs
		// longer than it.

View on GitHub (pinned to 82ba2681db)

Solutions

1. Retry the pipeline; transient netns/socket failures often clear under lighter load
2. Check host resource limits (ulimit -n, memory) on the Dagger engine host
3. Verify the container runtime allows socket creation inside netns (seccomp/apparmor profiles)
4. If using nested Dagger engines, test on the latest engine version and report persistent bind failures

err := dagDanger(func() error { return call.Func(ctx) })
if err != nil && strings.Contains(err.Error(), "listen for nested client") {
    time.Sleep(2 * time.Second)
    return call.Func(ctx) // retry once after transient netns/fd failure
}

When it happens

Trigger: runInNetNS(ctx, state, listenFn) returns an error: failure to enter the container netns, inability to bind a TCP socket on 127.0.0.1, or fd/resource exhaustion in the engine.

Common situations: Engine host under fd/memory pressure; network-namespace misconfiguration on the host; restrictive container runtimes or seccomp profiles blocking socket creation; running nested Dagger-in-Dagger in constrained environments.

Related errors

• failed to listen on network namespace: %w
• listen for local tunnel: %w
• listen: %w
• internal telemetry proxy listen: %w
• failed to create netNS sampler: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/d54bfb6592d84508. Report an issue: GitHub.