hashicorp/nomad · error

panic(err)

Error message

panic(err)

What it means

mustCNICheckConstraint parses the version constraint '>= 1.3.0' at package init to build the supportsCNICheck constraint used to decide whether the CNI check mode is available. It panics if version.NewConstraint returns an error; since the constraint string is a compile-time constant and valid, the panic is an unreachable invariant indicating the version-constraint library or build is broken, not user misconfiguration.

Source

Thrown at client/allocrunner/networking_cni.go:145

		taskenv.AllocID:   alloc.ID,         // NOMAD_ALLOC_ID
	} {
		// job ID and group name may contain ";" but CNI_ARGS are ";"-separated
		// per the spec, so they may not be used in arg keys or values.
		if strings.Contains(value, ";") {
			logger.Warn("Skipping CNI arg because it contains a semicolon",
				"key", key, "value", value)
		} else {
			cniArgs[key] = value
		}
	}
}

var supportsCNICheck = mustCNICheckConstraint()

func mustCNICheckConstraint() version.Constraints {
	v, err := version.NewConstraint(">= 1.3.0")
	if err != nil {
		panic(err)
	}
	return v
}

// Setup calls the CNI plugins with the add action
func (c *cniNetworkConfigurator) Setup(ctx context.Context, alloc *structs.Allocation, spec *drivers.NetworkIsolationSpec, created bool) (*structs.AllocNetworkStatus, error) {

	if err := c.ensureCNIInitialized(); err != nil {
		return nil, fmt.Errorf("cni not initialized: %w", err)
	}
	cniArgs := map[string]string{
		// CNI plugins are called one after the other with the same set of
		// arguments. Passing IgnoreUnknown=true signals to plugins that they
		// should ignore any arguments they don't understand
		"IgnoreUnknown": "true",
	}

	tg := alloc.Job.LookupTaskGroup(alloc.TaskGroup)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Restore the correct hashicorp/go-version dependency (go mod tidy / go mod verify)
2. If you edited the constraint string, fix its syntax per go-version grammar (e.g., '>= 1.3.0, < 2.0.0')
3. Rebuild from a clean checkout of the official release
4. Capture the panic error text — it names the invalid constraint — and correct it

Example fix

// before
v, err := version.NewConstraint(">= 1.3.0")
if err != nil {
	panic(err)
}
// after
v, err := version.NewConstraint(">= 1.3.0")
if err != nil {
	return nil, fmt.Errorf("invalid CNI check version constraint: %w", err)
}

// Validate version-constraint strings before they reach init-time parsing in forks/tools.
c, err := version.NewConstraint(">= 1.3.0")
if err != nil {
	return fmt.Errorf("invalid constraint: %w", err)
}
_ = c

// Go: recover around package initialization in plugin/extension hosts
func initNetworking() (err error) {
	defer func() {
		if r := recover(); r != nil {
			err = fmt.Errorf("CNI constraint init panicked: %v", r)
		}
	}()
	_ = supportsCNICheck
	return nil
}

When it happens

Trigger: Package initialization of client/allocrunner when version.NewConstraint(">= 1.3.0") errors — only possible with a broken/mismatched hashicorp/go-version dependency or an altered constraint string in a fork.

Common situations: Vendored go-version version drift or corruption; hand-edited constraint strings in forks that violate constraint grammar (e.g., '>= 1.3.0' typos like '>> 1.3.0'); never in stock builds.

Related errors

• cni not initialized: %w
• panic(err)
• network namespace already exists but was misconfigured
• no CNI network config found
• no default Consul services client

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e540c793c49fb4a5. Report an issue: GitHub.