What causes "failed to open netlink connection: %w" in lima-vm/lima?

Check the wrapped cause: EPROTONOSUPPORT means the kernel lacks SOCK_DIAG; EPERM means a security module blocks it.

failed to open netlink connection: %w

Error message

failed to open netlink connection: %w

What it means

NewLister dials the NETLINK_SOCK_DIAG family to enumerate TCP/UDP sockets via inet_diag. If the netlink socket cannot be created (permission denied, protocol family unavailable, seccomp/AppArmor restriction), the dial error is wrapped with this message.

Source

Thrown at pkg/guestagent/sockets/sockets_linux.go:103

		if family == unix.AF_INET6 {
			pname += "6"
		}

		newSocket := Socket{
			Kind:  pname,
			IP:    localIP,
			Port:  sport,
			State: state,
		}
		sockets = append(sockets, newSocket)
	}
	return sockets, nil
}

func NewLister() (*Lister, error) {
	conn, err := netlink.Dial(unix.NETLINK_SOCK_DIAG, nil)
	if err != nil {
		return nil, fmt.Errorf("failed to open netlink connection: %w", err)
	}
	return &Lister{conn: conn}, nil
}

type Lister struct {
	conn *netlink.Conn
}

func (lister *Lister) List() ([]Socket, error) {
	protos := []int{unix.IPPROTO_TCP, unix.IPPROTO_UDP}
	families := []int{unix.AF_INET, unix.AF_INET6}

	var sockets []Socket
	for _, proto := range protos {
		for _, fam := range families {
			msgs, err := query(lister.conn, fam, proto)
			if err != nil {
				continue

View on GitHub (pinned to dd909d0973)

Solutions

Check the wrapped cause: EPROTONOSUPPORT means the kernel lacks SOCK_DIAG; EPERM means a security module blocks it.
Run outside of restrictive sandboxes or update the seccomp/AppArmor profile to allow AF_NETLINK SOCK_DIAG.
Ensure a reasonably modern Linux kernel (inet_diag has long been standard).
Retry on transient resource errors (EMFILE/ENFILE — raise fd limits).

Example fix

// before: no fallback
tl, err := sockets.New()
// after: degrade gracefully
tl, err := sockets.New()
if err != nil {
	logrus.WithError(err).Warn("netlink sock-diag unavailable; port detection disabled")
}

Defensive patterns

Strategy: fallback

Validate before calling

// pre-check that sock diag netlink is available
conn, err := netlink.Dial(unix.NETLINK_SOCK_DIAG, nil)
if err != nil { /* port detection unavailable */ }
conn.Close()

Try / catch

lister, err := sockets.NewLister()
if err != nil {
	log.WithError(err).Warn("netlink sock-diag unavailable; falling back to no port detection")
	lister = nil
}

Prevention

Test sock-diag availability once at agent startup and degrade gracefully.
Keep seccomp/AppArmor profiles permissive for AF_NETLINK SOCK_DIAG.
Raise fd limits if EMFILE/ENFILE appears in the wrapped error.
Run integration tests in environments mirroring production sandboxing.

When it happens

Trigger: NewLister (invoked via New, or TestListS_Integration) when netlink.Dial(unix.NETLINK_SOCK_DIAG, nil) fails — kernel without SOCK_DIAG support, sandbox blocking netlink, or resource exhaustion.

Common situations: Running inside a container/sandbox that filters netlink sockets; hardened seccomp profile in the guest agent context; very old kernel lacking inet_diag; running tests in restricted CI environments.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/f10654cb2aafec55. Report an issue: GitHub.