hashicorp/nomad · critical

failed to configure network manager: %v

Error message

failed to configure network manager: %v

What it means

During alloc runner hook initialization, newNetworkManager (which selects the networking plugin/mode for the alloc, e.g. bridge or CNI) failed. initRunnerHooks aborts, so the allocation cannot be set up with its network isolation requirements. The underlying cause is wrapped in %v.

Source

Thrown at client/allocrunner/alloc_runner_hooks.go:98

	// Broadcast client alloc to listeners
	a.ar.allocBroadcaster.Send(calloc)
}

// initRunnerHooks initializes the runners hooks.
func (ar *allocRunner) initRunnerHooks(config *clientconfig.Config) error {
	hookLogger := ar.logger.Named("runner_hook")

	// create health setting shim
	hs := &allocHealthSetter{ar}

	// create network isolation setting shim
	ns := &allocNetworkIsolationSetter{ar: ar}

	// build the network manager
	nm, err := newNetworkManager(ar.Alloc(), ar.driverManager)
	if err != nil {
		return fmt.Errorf("failed to configure network manager: %v", err)
	}

	// create network configurator
	nc, err := newNetworkConfigurator(hookLogger, ar.Alloc(), config)
	if err != nil {
		return fmt.Errorf("failed to initialize network configurator: %v", err)
	}

	// Create the alloc directory hook. This is run first to ensure the
	// directory path exists for other hooks.
	alloc := ar.Alloc()

	ar.runnerHooks = []interfaces.RunnerHook{
		newIdentityHook(hookLogger, ar.widmgr),
		newAllocDirHook(hookLogger, ar.allocDir),
		newMaxRunDurationHook(hookLogger, alloc, ar.clientBaseLabels, ar.EnforceMaxRunDurationTimeout),
		newConsulHook(consulHookConfig{
			alloc:                   ar.alloc,

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Read the wrapped cause: it names whether bridge/CNI setup or plugin selection failed
2. Enable bridge networking on the client (Linux kernel modules, nomad agent with root/CAP_NET_ADMIN) and install CNI plugins
3. Verify the job's network mode is supported by the node's plugins/client config
4. Reschedule onto a node whose fingerprint reports the required network capability

Example fix

// before (job) - bridge mode on a node without CNI
network { mode = "bridge" }
// after - either install CNI plugins + run agent as root, or use host mode
network { mode = "host" }

// before scheduling jobs with mode="bridge", verify client capabilities
node, _, _ := client.Nodes().Info(ctx, nodeID, nil)
for _, dc := range node.Drivers { _ = dc }
// ensure CNI binaries exist:
// ls /opt/cni/bin/bridge && nomad agent runs with CAP_NET_ADMIN

When it happens

Trigger: newNetworkManager returns error when the alloc requires networking but no suitable network plugin/node driver capability is available — e.g. the node lacks bridge networking support (no cap_net_admin, CNI not configured) while the job uses bridge networking mode.

Common situations: Job with `network { mode = "bridge" }` scheduled to a node without bridge networking enabled (client config `bridge_network_name`/CNI missing); missing netns/CNI plugins in /opt/cni/bin; running the Nomad agent without root or CAP_NET_ADMIN; driver/plugin not reporting the network-isolation capability.

Related errors

• failed to initialize network configurator: %v
• network namespace already exists but was misconfigured
• no CNI network config found
• failed to create network for alloc: %v
• %w: destroying network to retry failed: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/64b36b6024495438. Report an issue: GitHub.