hashicorp/nomad · error

failed to get the current netns: %v

Error message

failed to get the current netns: %v

What it means

Inside a locked OS thread, NewNS first obtains a handle to the thread's current network namespace via GetNS(getCurrentThreadNetNSPath()). If that fails, the error is wrapped as 'failed to get the current netns'. This typically means the per-thread namespace file under /proc could not be opened.

Source

Thrown at client/lib/nsutil/netns_linux.go:99

	// is in-use
	defer os.RemoveAll(nsPath)

	var wg sync.WaitGroup
	wg.Add(1)

	// do namespace work in a dedicated goroutine, so that we can safely
	// Lock/Unlock OSThread without upsetting the lock/unlock state of
	// the caller of this function
	go (func() {
		defer wg.Done()
		runtime.LockOSThread()
		// Don't unlock. By not unlocking, golang will kill the OS thread when the
		// goroutine is done (for go1.10+)

		var origNS NetNS
		origNS, err = GetNS(getCurrentThreadNetNSPath())
		if err != nil {
			err = fmt.Errorf("failed to get the current netns: %v", err)
			return
		}
		defer origNS.Close()

		// create a new netns on the current thread
		err = unix.Unshare(unix.CLONE_NEWNET)
		if err != nil {
			err = fmt.Errorf("error from unshare: %v", err)
			return
		}

		// Put this thread back to the orig ns, since it might get reused (pre go1.10)
		defer origNS.Set()

		// bind mount the netns from the current thread (from /proc) onto the
		// mount point. This causes the namespace to persist, even when there
		// are no threads in the ns.
		err = unix.Mount(getCurrentThreadNetNSPath(), nsPath, "none", unix.MS_BIND, "")

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Ensure /proc is mounted with default options in the container/runtime
2. Check file permissions on /proc/self/ns/net (readable by the process user)
3. Verify no seccomp/LSM policy blocks opening /proc/*/ns/* files
4. Confirm the Go runtime version is modern (go1.10+ behavior of thread lifetime is assumed by this code)

Example fix

// before: /proc not mounted in container
// after: mount proc in container spec
// mounts: [{destination: "/proc", type: "proc", source: "proc"}]
ns, err := nsutil.NewNS()

if _, err := os.Stat("/proc/self/ns/net"); err != nil {
    return fmt.Errorf("/proc namespaces unavailable: %v", err)
}

ns, err := nsutil.NewNS()
if err != nil && strings.Contains(err.Error(), "failed to get the current netns") {
    return fmt.Errorf("cannot access /proc/<tid>/ns/net; check /proc mount and permissions: %w", err)
}

When it happens

Trigger: GetNS on /proc/<tid>/ns/net fails while switching into a new namespace during NewNS — e.g. /proc not mounted, missing read permission on the ns file, or the namespace file disappeared because the thread exited.

Common situations: Containers without /proc mounted (rare but possible with custom runtime configs); host with hidepid mount option on /proc restricting access; highly restricted seccomp profiles blocking open of /proc files.

Related errors

• failed to open current netns: %v
• Failed to open current namespace: %v
• mount --make-rshared %s failed: %q
• mount --rbind %s %s failed: %q
• error from unshare: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/291c34165cf171fe. Report an issue: GitHub.