slackhq/nebula · error

SetNonblock: %v

Error message

SetNonblock: %v

What it means

Once the utun is connected and named, newTun puts the file descriptor into non-blocking mode with unix.SetNonblock so nebula can integrate it with its read loops. If SetNonblock fails, this error wraps the errno. Failure here means the fd exists but its flags cannot be manipulated, which is very unusual.

Source

Thrown at overlay/tun_darwin.go:120

		return nil, fmt.Errorf("CTLIOCGINFO: %v", err)
	}

	err = unix.Connect(fd, &unix.SockaddrCtl{
		ID:   ctlInfo.Id,
		Unit: uint32(ifIndex) + 1,
	})
	if err != nil {
		return nil, fmt.Errorf("SYS_CONNECT: %v", err)
	}

	name, err = unix.GetsockoptString(fd, unix.AF_SYS_CONTROL, _UTUN_OPT_IFNAME)
	if err != nil {
		return nil, fmt.Errorf("failed to retrieve tun name: %w", err)
	}

	err = unix.SetNonblock(fd, true)
	if err != nil {
		return nil, fmt.Errorf("SetNonblock: %v", err)
	}

	t := &tun{
		f:           os.NewFile(uintptr(fd), ""),
		Device:      name,
		vpnNetworks: vpnNetworks,
		DefaultMTU:  c.GetInt("tun.mtu", DefaultMTU),
		l:           l,
	}

	err = t.reload(c, true)
	if err != nil {
		return nil, err
	}

	c.RegisterReloadCallback(func(c *config.C) {
		err := t.reload(c, false)
		if err != nil {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check for duplicate nebula instances racing over the same TUN lifecycle and ensure only one manages the device.
2. Inspect open file descriptor limits (ulimit -n) and close leaks; retry after freeing descriptors.
3. Restart the host if the fd table is corrupted (EBADF on a freshly created fd is otherwise nearly impossible).

if err := start(); err != nil && strings.Contains(err.Error(), "SetNonblock") {
    // check fd limits and for concurrent Close() racing startup
}

When it happens

Trigger: unix.SetNonblock(fd, true) returns an error — invalid fd state, fd closed concurrently by another goroutine, or resource exhaustion (EBADF/ENOMEM class errors).

Common situations: Concurrent shutdown racing startup (Close called while Activate/newTun runs); extreme fd exhaustion from leaked descriptors; kernel bugs on unusual macOS versions.

Related errors

• system socket: %v
• CTLIOCGINFO: %v
• SYS_CONNECT: %v
• failed to retrieve tun name: %w
• newTunFromFd not supported in Darwin

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/69dfec30c124b50f. Report an issue: GitHub.