Fails to start on gVisor: "subscribe netlink groups: operation not supported" even without auto_detect_interface
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 70/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- go
- Domain
- networking
Research direction
Read sing-tun's Linux monitor in monitor_linux.go and compare its creation behavior with the existing Android probe; the issue identifies the failing bind and proposes probing it during monitor creation. Reproduce with the minimal inbound-only config under gVisor, then verify startup succeeds when auto_detect_interface is disabled and still reports the unsupported bind when enabled.
Written by the indexing model from the issue text.
Description
Operating system
Linux
System version
gVisor（uname -r：4.19.0-gvisor）
Installation type
Original sing-box Command Line
If you are using a graphical client, please provide the version of the client.
No response
Version
sing-box version 1.14.3
Environment: go1.26.8 linux/amd64
Description
On gVisor, sing-box exits at startup even with a minimal inbound-only config:
start service: initialize network: subscribe netlink groups: operation not supported
gVisor doesn't support binding a NETLINK_ROUTE socket to multicast groups.
In route/network.go, a network monitor creation error is tolerated when
auto_detect_interface is disabled, but sing-tun's Linux NewNetworkUpdateMonitor
always succeeds and the bind only fails in Start(), which is always fatal.
So there is no way to run sing-box on gVisor, even though this config never needs the monitor.
1.13.11 fails the same way ("subscribe route updates").
Suggested fix (sing-tun monitor_linux.go): probe the group bind when creating
the monitor, like the existing Android probe, so sing-box's existing
"tolerate creation error unless auto_detect_interface" path applies.
No sing-box code change needed, only a sing-tun bump.
@@ func NewNetworkUpdateMonitor(logger logger.Logger) (NetworkUpdateMonitor, error)
if err != nil {
return nil, ErrNetlinkBanned
}
+ } else {
+ // netlink multicast groups may be unsupported, e.g. in gVisor
+ netlinkSocket, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_RAW|unix.SOCK_CLOEXEC, unix.NETLINK_ROUTE)
+ if err != nil {
+ return nil, E.Cause(err, "create netlink socket")
+ }
+ err = unix.Bind(netlinkSocket, &unix.SockaddrNetlink{
+ Family: unix.AF_NETLINK,
+ Groups: netlinkGroups,
+ })
+ unix.Close(netlinkSocket)
+ if err != nil {
+ return nil, E.Cause(err, "subscribe netlink groups")
+ }
}
return monitor, nil
}
Tested: v1.14.3 built with this patch on gVisor (4.19.0-gvisor) starts normally;
VLESS / AnyTLS / VLESS-REALITY inbounds work end to end;
with auto_detect_interface: true it still fails, now at creation time with a clear error.
Reproduction
config.json:
{"inbounds":[{"type":"mixed","listen_port":1080}]}
docker run --rm --runtime=runsc -v $PWD:/w sing-box run -c /w/config.json
Logs
FATAL[0000] start service: initialize network: subscribe netlink groups: operation not supported
Supporter
- I am a sponsor
Integrity requirements
- I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
- I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
- I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
- I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.
- Dominant language
- Go
- Stars
- 38.9k
- Forks
- 4.7k
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from SagerNet/sing-box
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
All issues in SagerNet/sing-box
Similar issues
-
ViewData can pair the in-flight proposal with the prepared flag of another proposalPossibly taken @HagarMeir claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
hyperledger/SmartBFT#710 ·
Maintainers usually reply within 1 day
-
agent-butler-finding chore
Difficulty 1/5 Under an hour Newbie friendliness 90/100
jordansmall/spindrift#5575 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
open-telemetry/opentelemetry-go-compile-instrumentation#1512 ·
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
slavakurilyak/awesome-ai-agents#805 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
JakeChampion/lang#12684 ·
Maintainers usually reply within 1 day