kopia/kopia · error

Too many activated sockets found. Expected 1, got

Error message

Too many activated sockets found.  Expected 1, got %v

What it means

startServerWithOptionalTLS uses socket activation (systemd-style LISTEN_FDS); if more than one pre-activated socket is passed to the process, it refuses to guess which to use and returns this error. It is a guard against ambiguous multi-socket activation.

Solutions

1. Configure only ONE ListenStream=/socket in the systemd socket unit (e.g. split into separate units)
2. Check the environment: unset/fix LISTEN_FDS, LISTEN_FDNAMES, LISTEN_PID before starting Kopia manually
3. Skip socket activation and pass an explicit --address instead

Example fix

# before
[Socket]
ListenStream=0.0.0.0:51515
ListenStream=/run/kopia.sock
# after
[Socket]
ListenStream=0.0.0.0:51515

if os.Getenv("LISTEN_FDS") != "" {
    n, _ := strconv.Atoi(os.Getenv("LISTEN_FDS"))
    if n > 1 { log.Fatal("kopia supports exactly 1 activated socket") }
}

When it happens

Trigger: Launching `kopia server start` with LISTEN_FDS/LISTEN_FDNAMES set to more than one socket, e.g. a systemd socket unit with multiple ListenStream= entries or ListenStream= plus ListenDatagram=.

Common situations: systemd .socket units with several Listen directives; container supervisors passing multiple inherited fds; misconfigured activation environment variables left set in a service file.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• socket-activation error
• arguments to diff must both be directories or both…
• cache directory was not absolute, refusing to delete
• can't open storage
• cannot write to repo connection with permissive cache…

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/493e4284438f8d2b. Report an issue: GitHub.

Appendix: source

Thrown at cli/command_server_tls.go:63

	if err != nil {
		return errors.Wrap(err, "socket-activation error")
	}

	switch len(listeners) {
	case 0:
		if after, ok := strings.CutPrefix(httpServer.Addr, "unix:"); ok {
			l, err = (&net.ListenConfig{}).Listen(ctx, "unix", after)
		} else {
			l, err = (&net.ListenConfig{}).Listen(ctx, "tcp", httpServer.Addr)
		}

		if err != nil {
			return errors.Wrap(err, "listen error")
		}
	case 1:
		l = listeners[0]
	default:
		return errors.Errorf("Too many activated sockets found.  Expected 1, got %v", len(listeners))
	}

	if err := insecureserverbind.ValidateListenerAddrIfRestricted(
		c.serverStartInsecure,
		c.serverStartWithoutPassword,
		c.serverStartAllowDangerousUnauthenticatedNetwork,
		l.Addr(),
	); err != nil {
		l.Close() //nolint:errcheck

		return errors.Wrap(err, "insecure server bind validation")
	}

	defer l.Close() //nolint:errcheck

	httpServer.Addr = l.Addr().String()

	return c.startServerWithOptionalTLSAndListener(ctx, httpServer, l)

View on GitHub (pinned to 82495e54b5)