bootstrap firewall management is only supported on Linux

Error message

bootstrap firewall management is only supported on Linux

What it means

On non-Linux platforms the firewall module is compiled to a stub that cannot manage any firewall, so apply() unconditionally returns this error. Firewall bootstrap management is implemented only against Linux backends (nftables/ufw/firewalld); the stub exists to keep the crate cross-platform while making unsupported calls explicit.

Solutions

Run the firewall bootstrap on a Linux host (or Linux container/VM).
Guard the call at compile time with #[cfg(target_os = "linux")] and skip or no-op elsewhere.
Skip firewall steps in CI on non-Linux runners (conditional job steps).
Use the platform's native firewall tooling (pf on macOS, Windows Firewall) outside this library.

Example fix

// before
apply(&request, dry_run, yes)?; // panics/errors on macOS
// after
#[cfg(target_os = "linux")]
apply(&request, dry_run, yes)?;
#[cfg(not(target_os = "linux"))]
eprintln!("firewall management skipped: only supported on Linux");

Defensive patterns

Strategy: try-catch

Validate before calling

#[cfg(target_os = "linux")]
fn firewall_supported() -> bool { true }
#[cfg(not(target_os = "linux"))]
fn firewall_supported() -> bool { false }

Type guard

fn is_linux() -> bool { cfg!(target_os = "linux") }

Try / catch

if !is_linux() {
    eprintln!("firewall bootstrap requires Linux; skipping");
} else {
    apply(&request, dry_run, yes)?;
}

Prevention

Gate firewall steps behind an OS check
Restrict firewall CI jobs to Linux runners
Skip or substitute native firewall tooling on macOS/Windows
Document platform requirements in runbooks

When it happens

Trigger: Calling the firewall apply() entry point (FirewallRequest, dry_run, yes) on macOS, Windows, or any non-Linux target — regardless of request contents or dry_run flag.

Common situations: Developing or running the bootstrap command on a macOS laptop; running the tool in a Windows CI job; cross-platform scripts that invoke firewall management without a platform guard.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/db017b39a8a8529f. Report an issue: GitHub.

Appendix: source

Thrown at src/system/firewall_non_linux.rs:48

}

pub(crate) fn inspect_request(_request: &mut FirewallRequest) -> Result<()> {
    Ok(())
}

impl FirewallRequest {
    pub(crate) fn plans(&self) -> Vec<ResourcePlan> {
        vec![ResourcePlan::new(
            ResourceId::new("firewall", "linux"),
            "unsupported platform",
            "configured Linux firewall",
            ResourceAction::Unknown,
        )]
    }
}

pub(crate) fn apply(_request: &FirewallRequest, _dry_run: bool, _yes: bool) -> Result<()> {
    bail!("bootstrap firewall management is only supported on Linux")
}

pub(crate) fn inspect_privileged_plan_from_stdin() -> Result<()> {
    bail!("bootstrap firewall management is only supported on Linux")
}

pub(crate) fn apply_privileged_plan_from_stdin() -> Result<()> {
    bail!("bootstrap firewall management is only supported on Linux")
}

fn configured(config: &Config) -> bool {
    config.config_files.values().any(|cf| {
        cf.bootstrap_config()
            .and_then(|bootstrap| bootstrap.linux.firewall)
            .is_some_and(|firewall| {
                let _ = firewall.values.len();
                true
            })

View on GitHub (pinned to 533346cc37)