What causes "Cannot create spawn server. " in netdata/netdata?

Check errno-producing conditions around process creation: raise 'ulimit -n' if fd exhaustion is plausible.

Cannot create spawn server.

Error message

Cannot create spawn server.

What it means

On builds with LOCAL_SOCKETS_USE_SETNS (Linux with network-namespace support), local_listeners uses a spawn server so worker children can enter other processes' network namespaces via setns(). spawn_server_create() returning NULL means the IPC infrastructure for those callbacks could not be initialized. The tool exits 1 because socket enumeration across namespaces cannot proceed without it.

Source

Thrown at src/collectors/utils/local_listeners.c:267

        }
        else if (strcmp("procfile", s) == 0) {
            ls.config.procfile = positive;
            // fprintf(stderr, "%s procfile\n", positive ? "enabling" : "disabling");
        }
        else if (strcmp("report", s) == 0) {
            ls.config.report = positive;
            // fprintf(stderr, "%s report\n", positive ? "enabling" : "disabling");
        }
        else {
            fprintf(stderr, "Unknown parameter %s\n", s);
            exit(1);
        }
    }

#if defined(LOCAL_SOCKETS_USE_SETNS)
    SPAWN_SERVER *spawn_server = spawn_server_create(SPAWN_SERVER_OPTION_CALLBACK, NULL, local_sockets_spawn_server_callback, argc, (const char **)argv);
    if(spawn_server == NULL) {
        fprintf(stderr, "Cannot create spawn server.\n");
        exit(1);
    }

    ls.spawn_server = spawn_server;
#endif

    local_sockets_process(&ls);

#if defined(LOCAL_SOCKETS_USE_SETNS)
    spawn_server_destroy(spawn_server);
#endif

    getrusage(RUSAGE_SELF, &ended);

    if(debug) {
        unsigned long long user   = ended.ru_utime.tv_sec * 1000000ULL + ended.ru_utime.tv_usec - started.ru_utime.tv_sec * 1000000ULL + started.ru_utime.tv_usec;
        unsigned long long system = ended.ru_stime.tv_sec * 1000000ULL + ended.ru_stime.tv_usec - started.ru_stime.tv_sec * 1000000ULL + started.ru_stime.tv_usec;
        unsigned long long total  = user + system;

View on GitHub (pinned to 4864de85e2)

Solutions

Check errno-producing conditions around process creation: raise 'ulimit -n' if fd exhaustion is plausible.
Run outside restrictive sandboxes (seccomp/container profiles that block socketpair or clone) or grant the needed syscalls.
If namespace traversal is not required, use a build without LOCAL_SOCKETS_USE_SETNS so the spawn server is never created.
Report upstream with strace output if spawn_server_create fails on an unconfined system.

Defensive patterns

Strategy: fallback

Validate before calling

# detect sandbox restrictions that break the spawn server before running
if grep -q 'NoNewPrivs:.*yes' /proc/self/status 2>/dev/null; then
  echo 'no_new_privs active: spawn server may fail' >&2
fi
ulimit -n  # ensure a sane fd limit for socketpair/fork

Prevention

Run outside seccomp/no_new_privs sandboxes or grant socketpair/fork syscalls
Raise fd limits in long-lived wrappers
Build without LOCAL_SOCKETS_USE_SETNS when namespace traversal is unnecessary

When it happens

Trigger: Building/running on a platform where the spawn server cannot be created: socketpair/pipe allocation failure under heavy fd pressure, a failed fork during server setup, or memory exhaustion. The call passes SPAWN_SERVER_OPTION_CALLBACK with local_sockets_spawn_server_callback plus argc/argv so children re-run the same command line in target namespaces.

Common situations: Running under a restrictive sandbox/seccomp profile that blocks the socket/fork primitives the spawn server needs, fd ulimit exhaustion in long-lived wrapper processes, or container runtimes denying namespace-related syscalls.

Related errors

AI-assisted analysis of netdata/netdata@4864de85e2 (2026-08-15). Data as JSON: /api/errors/ad3ed6e66e2ee1c3. Report an issue: GitHub.