jdx/mise · error

no supported firewall backend found (tried nft…

Error message

no supported firewall backend found (tried nft, firewall-cmd, and ufw)

What it means

mise's firewall bootstrap needs a supported firewall backend to inspect and apply rules. It probes nft (nftables), firewall-cmd (firewalld), and ufw in that order; if none of the binaries is present or functional on the host it cannot manage the firewall and returns this error from detect_backend.

Solutions

1. Install one of the supported backends: `apt install nftables` (or ufw / firewalld depending on your distro).
2. Ensure the tool is on PATH for the user running mise (check with `which nft firewall-cmd ufw`).
3. Explicitly pin a backend you know exists via the [firewall] config's backend setting.
4. If you do not want mise to manage the firewall at all, remove the [firewall] section from your config.

Example fix

// before (Debian/Ubuntu host, no backend)
$ mise bootstrap firewall status
error: no supported firewall backend found...

// after
$ sudo apt install nftables
$ mise bootstrap firewall status

for tool in ["nft", "firewall-cmd", "ufw"] {
    if which(tool).is_some() { break; }
    eprintln!("{tool} not found");
}
// abort early if none found before invoking mise bootstrap firewall

fn has_firewall_backend(path: &str) -> bool {
    ["nft", "firewall-cmd", "ufw"].iter().any(|t| path.join(t).exists())
}

match result {
    Err(e) if e.to_string().contains("no supported firewall backend") => {
        eprintln!("install nftables, firewalld, or ufw on this host first");
    }
    other => other?,
}

When it happens

Trigger: Running any `mise bootstrap firewall ...` command on a host where neither nft, firewall-cmd, nor ufw is installed (or none is callable via PATH / backend_available fails), and no explicit backend was requested (or the requested one also failed ensure_backend_available).

Common situations: Minimal containers or VM images without any firewall userspace tools installed; macOS development machines; servers using only raw iptables-legacy; stripped-down CI environments.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• firewall backend ' ' requires command
• apt-cache not found
• bootstrap compose project
• bootstrap firewall management is only supported on Linux
• cannot check staged changes: git is unavailable

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/a7051e76d2a1e480. Report an issue: GitHub.

Appendix: source

Thrown at src/system/firewall.rs:986

        && backend_available(state.backend)
    {
        return Ok(state.backend);
    }
    for backend in [FirewallBackend::Firewalld, FirewallBackend::Ufw] {
        if backend_available(backend) && backend_active(backend) {
            return Ok(backend);
        }
    }
    for backend in [
        FirewallBackend::Nftables,
        FirewallBackend::Firewalld,
        FirewallBackend::Ufw,
    ] {
        if backend_available(backend) {
            return Ok(backend);
        }
    }
    bail!("no supported firewall backend found (tried nft, firewall-cmd, and ufw)")
}

fn ensure_backend_available(backend: FirewallBackend) -> Result<()> {
    if backend_available(backend) {
        Ok(())
    } else {
        bail!(
            "firewall backend '{}' requires command '{}'",
            backend.label(),
            backend.program().unwrap_or_default()
        )
    }
}

fn backend_available(backend: FirewallBackend) -> bool {
    backend.program().and_then(crate::file::which).is_some()
}

View on GitHub (pinned to 533346cc37)