jdx/mise · error

bootstrap firewall management is only supported on Linux

Error message

bootstrap firewall management is only supported on Linux

What it means

On macOS and Windows, mise compiles firewall_non_linux.rs as the firewall implementation; its apply() unconditionally bails because bootstrap firewall management (iptables/nftables) is Linux-only. Any code path that reaches firewall::apply on a non-Linux host gets this error instead of attempting firewall changes.

Source

Thrown at src/system/firewall_non_linux.rs:48

}

pub fn inspect_request(_request: &mut FirewallRequest) -> Result<()> {
    Ok(())
}

impl FirewallRequest {
    pub fn plans(&self) -> Vec<ResourcePlan> {
        vec![ResourcePlan::new(
            ResourceId::new("firewall", "linux"),
            "unsupported platform",
            "configured Linux firewall",
            ResourceAction::Unknown,
        )]
    }
}

pub fn apply(_request: &FirewallRequest, _dry_run: bool, _yes: bool) -> Result<()> {
    bail!("bootstrap firewall management is only supported on Linux")
}

pub fn inspect_privileged_plan_from_stdin() -> Result<()> {
    bail!("bootstrap firewall management is only supported on Linux")
}

pub fn apply_privileged_plan_from_stdin() -> Result<()> {
    bail!("bootstrap firewall management is only supported on Linux")
}

fn configured(config: &Config) -> bool {
    config.config_files.values().any(|cf| {
        cf.bootstrap_config()
            .and_then(|bootstrap| bootstrap.linux.firewall)
            .is_some_and(|firewall| {
                let _ = firewall.values.len();
                true
            })

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Run the firewall bootstrap step only on Linux hosts
2. Move [bootstrap.linux.firewall] into a Linux-only config file or template it per-OS so macOS/Windows never load it
3. Skip the firewall step on non-Linux in automation scripts

Example fix

# before: shared mise.toml on every machine
[bootstrap.linux.firewall]
rules = { allow_ssh_22 = { port = 22 } }

# after: keep that section only in the config file used on Linux hosts,
# and remove it from the macOS/Windows config

# gate the firewall step by OS in scripts
if [ "$(uname -s)" = Linux ]; then
  mise bootstrap   # includes firewall step
else
  mise bootstrap --skip system/firewall 2>/dev/null || mise bootstrap
fi

When it happens

Trigger: The firewall apply step (from `mise bootstrap` or the system/firewall CLI surface) executes on macOS or Windows, regardless of whether a firewall request was built.

Common situations: A dotfiles/team mise.toml containing [bootstrap.linux.firewall] gets run on a Mac; CI matrix jobs that run identical bootstrap scripts on multiple operating systems; orchestration that calls the firewall step unconditionally across a mixed fleet.

Related errors

• bootstrap users and groups are only supported on Linux
• refusing unsafe firewall change; inspect `mise bootstrap fir
• no supported firewall backend found (tried nft, firewall-cmd
• firewall rule name '{name}' must contain only ASCII letters,
• per-host network filtering (--allow-net=<host>) is not suppo

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/db017b39a8a8529f. Report an issue: GitHub.