valyala/fasthttp · error

cannot create listening socket: %w

Error message

cannot create listening socket: %w

What it means

Returned by newSocketCloexecOld (the fallback path of newSocketCloexec) when the raw unix.Socket(domain, typ, proto) syscall fails to create a listening socket fd. This is the low-level socket(2) call failing, before any bind/listen happens. The wrapped errno tells which resource or protocol constraint was hit.

Source

Thrown at tcplisten/socket.go:20

package tcplisten

import (
	"fmt"
	"syscall"

	"golang.org/x/sys/unix"
)

func newSocketCloexecOld(domain, typ, proto int) (int, error) {
	syscall.ForkLock.RLock()
	fd, err := unix.Socket(domain, typ, proto)
	if err == nil {
		unix.CloseOnExec(fd)
	}
	syscall.ForkLock.RUnlock()
	if err != nil {
		return -1, fmt.Errorf("cannot create listening socket: %w", err)
	}
	if err = unix.SetNonblock(fd, true); err != nil {
		unix.Close(fd)
		return -1, fmt.Errorf("cannot make non-blocked listening socket: %w", err)
	}
	return fd, nil
}

View on GitHub (pinned to c96f600972)

Solutions

1. Raise fd limits: ulimit -n / systemd LimitNOFILE, and sysctl fs.file-max if system-wide exhaustion.
2. Fix fd leaks in the app (check with lsof / /proc/<pid>/fd count).
3. Adjust seccomp/container profiles to allow socket() for the needed address family, or enable IPv6 if tcp6 is required.
4. Check dmesg/kernel logs for ENOMEM/ENOBUFS and increase kernel memory or reduce load.

Example fix

// before
# default ulimit -n 1024 under heavy load
// after
# systemd unit
[Service]
LimitNOFILE=65535

// Pre-flight: try creating a socket of the same family
fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM|syscall.SOCK_NONBLOCK, 0)
if err != nil { log.Fatalf("cannot create sockets (limits/seccomp?): %v", err) }
syscall.Close(fd)

ln, err := s.Listen(addr)
if err != nil {
    if strings.Contains(err.Error(), "cannot create listening socket") {
        if errors.Is(err, syscall.EMFILE) || errors.Is(err, syscall.ENFILE) {
            log.Fatalf("fd limit hit, raise ulimit -n: %v", err)
        }
        log.Fatalf("socket() blocked or unsupported: %v", err)
    }
}

When it happens

Trigger: EMFILE/ENFILE (process or system file descriptor table full), ENOMEM/ENOBUFS (kernel memory shortage), EPROTONOSUPPORT/EAFNOSUPPORT (unsupported domain/protocol — e.g. requesting a socket family the kernel doesn't support), or EPERM under restrictive seccomp policies.

Common situations: Applications with thousands of open fds hitting RLIMIT_NOFILE; hosts with fs.file-max exhausted; containers with seccomp profiles blocking socket() for the requested domain; IPv6-disabled kernels when tcp6 sockets are requested.

Related errors

• value is negative, cannot convert to uintptr
• prefork: listen tcp %s: %w
• cannot make non-blocked listening socket: %w
• cannot create listening unblocked socket: %w
• cannot create listening socket: %w

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/d7ed3d581956a668. Report an issue: GitHub.