hashicorp/nomad · error

failed to cleanup iptables rules for alloc %s

Error message

failed to cleanup iptables rules for alloc %s

What it means

forceCleanup could not delete the alloc's jump rule from nat POSTROUTING and/or clear-and-delete its per-alloc CNI chain; both failures are aggregated into this final error, leaving residual iptables state for the allocation.

Source

Thrown at client/allocrunner/networking_cni.go:693

		`-j`,
		chainID,
	}

	// remove the jump rule
	ok := true
	if err = ipt.Delete(natTable, postRoutingChain, toDel...); err != nil {
		c.logger.Warn("failed to remove iptables nat.POSTROUTING rule", "alloc_id", allocID, "chain", chainID, "error", err)
		ok = false
	}

	// remote the associated chain
	if err = ipt.ClearAndDeleteChain(natTable, chainID); err != nil {
		c.logger.Warn("failed to remove iptables nat chain", "chain", chainID, "error", err)
		ok = false
	}

	if !ok {
		return fmt.Errorf("failed to cleanup iptables rules for alloc %s", allocID)
	}

	return nil
}

func (c *cniNetworkConfigurator) ensureCNIInitialized() error {
	if err := c.cni.Status(); !cni.IsCNINotInitialized(err) {
		return err
	}
	opt, err := c.confParser.getOpt()
	if err != nil {
		return err
	}
	return c.cni.Load(opt)
}

// nsOpts keeps track of NamespaceOpts usage, mainly for test assertions.
type nsOpts struct {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Run the listed iptables delete commands manually for the alloc's chain
2. Check for rules referenced by other processes preventing chain deletion
3. Verify iptables permissions and netfilter kernel module availability

When it happens

Trigger: Thrown at client/allocrunner/networking_cni.go:693 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1d6c623be38f2086. Report an issue: GitHub.