hashicorp/vagrant · error · Vagrant::Errors.CFEngineBootstrapFailed

Failed to bootstrap CFEngine. Please see the output above to

Error message

Failed to bootstrap CFEngine. Please see the output above to
see what went wrong and address the issue.

What it means

Raised when `cfagent("--bootstrap <policy_server_address>")` runs with error_check disabled and returns a non-zero exit code. Bootstrap already has an address (from config or auto-detection); the failure is inside the guest: cf-agent could not reach, trust, or register with the policy hub. The real cause is printed in the cf-agent output streamed just above this error.

Source

Thrown at plugins/provisioners/cfengine/provisioner.rb:97

      def handle_cfengine_bootstrap
        @logger.info("Bootstrapping CFEngine...")
        if !@machine.guest.capability(:cfengine_needs_bootstrap, @config)
          @machine.ui.info(I18n.t("vagrant.cfengine_no_bootstrap"))
          return
        end

        # Needs bootstrap, let's determine the parameters
        policy_server_address = @config.policy_server_address
        if !policy_server_address
          policy_server_address = @machine.guest.capability(:read_ip_address)
          raise Vagrant::Errors::CFEngineCantAutodetectIP if !policy_server_address
          @machine.ui.info(I18n.t("vagrant.cfengine_detected_ip", address: policy_server_address))
        end

        @machine.ui.info(I18n.t("vagrant.cfengine_bootstrapping",
                                policy_server: policy_server_address))
        result = cfagent("--bootstrap #{policy_server_address}", error_check: false)
        raise Vagrant::Errors::CFEngineBootstrapFailed if result != 0

        # Policy hubs need to do additional things before they're ready
        # to accept agents. Force that run now...
        if @config.am_policy_hub
          @machine.ui.info(I18n.t("vagrant.cfengine_bootstrapping_policy_hub"))
          cfagent("-KI -f /var/cfengine/masterfiles/failsafe.cf#{cfagent_classes_args}")
          cfagent("-KI #{cfagent_classes_args}#{cfagent_extra_args}")
        end
      end

      # This handles verifying the CFEngine installation, installing it
      # if it was requested, and so on. This method will raise exceptions
      # if things are wrong.
      def handle_cfengine_installation
        if !@machine.guest.capability?(:cfengine_installed)
          @machine.ui.warn(I18n.t("vagrant.cfengine_cant_detect"))
          return
        end

View on GitHub (pinned to 35f3160f4a)

Solutions

1. Read the cf-agent output printed above the error - it names the exact bootstrap failure
2. From the guest, verify hub reachability: `nc -vz <policy_server> 5308` (TCP and UDP)
3. Correct `cfengine.policy_server_address` in the Vagrantfile to the hub's real address as seen from the guest
4. Check hub and agent CFEngine major versions match and that /var/cfengine/ppkeys on the guest is not in a bad half-bootstrapped state (remove it and re-provision)

Example fix

# Vagrantfile - before (wrong hub address for this network)
cfengine.policy_server_address = "192.168.10.5"

# Vagrantfile - after (hub reachable on the host-only network)
cfengine.policy_server_address = "192.168.33.10"

# Pre-flight from the host before provisioning
system("vagrant ssh -c 'nc -z #{hub} 5308 && echo HUB_REACHABLE'") or abort "Policy hub #{hub} unreachable"

begin
  Vagrant::Environment.new.cli(%w[provision])
rescue Vagrant::Errors::CFEngineBootstrapFailed
  warn "cf-agent bootstrap failed - check hub reachability (port 5308) and cf-agent output"
  exit 1
end

When it happens

Trigger: Calling `vagrant provision` (or first `vagrant up`) with the cfengine provisioner where the policy server is unreachable from the guest (blocked port 5308 TCP/UDP), the address is wrong, hub/agent CFEngine versions are incompatible, or bootstrap keys are rejected.

Common situations: Firewall or security group blocks CFEngine's port 5308; policy_server_address points to the wrong interface; NAT address (10.0.2.2) used when the hub runs on another host; cf-agent keys/bootstrapping state already corrupt in the box.

Related errors

• Vagrant was unable to automatically detect the IP address of
• CFEngine appears not to be installed on the guest machine. V
• This Vagrant environment has specified that it requires the
• The box '%{name}' could not be found or could not be accesse
• There was an error while downloading the metadata for this b

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/42c8da27345af54d. Report an issue: GitHub.