Skip to main content

NFT000 - nft Command Not Available

Uploading...Agent error code #NFT000 indicates that the agent could not run the nft binary on the host it is running on. The nftables backend drives the kernel ruleset by shelling out to nft, so without that binary no grant can be applied.

The agent reports this when it runs nft --version and the command does not exist or will not start. It is raised by Validate connection on the knoc, and by the capability probe the agent runs when it registers with the server, which is why the nftables option can be missing from the knoc wizard on a host that has not installed the package.

Two neighboring outcomes have their own reports. An nft that is installed but does not answer in time is reported as a timeout rather than as this code, and an nft that runs while the set listing fails is #NFT400.

Common causes include:

    The nftables package is not installed on the agent host nft is installed outside the PATH the agent process was started with The agent runs in a minimal container image that omits the userspace tools

    Steps to Resolve

    Install the nftables Userspace Tools

      On Debian or Ubuntu, run sudo apt install nftables On RHEL, Rocky or Alma, run sudo dnf install nftables Confirm the binary responds: nft --version

      Check the Agent's PATH

      The agent resolves nft against the PATH its own process inherited from the service manager, not the one in your login shell.

        Find the binary: command -v nft. It is normally /usr/sbin/nft, and /sbin/nft on hosts that do not merge sbin If it sits in a directory the service PATH does not include, add the directory in the unit file or symlink the binary into one that is already there Restart the agent so it picks up the change

        Ask knocker What the Host Has

        On the agent host:

        knocker status nftables

        The first line reports whether nft was found, and the command prints the next step for whatever it finds missing.

        Confirm the Backend Type Suits the Host

        The nftables backend manages named sets in the kernel ruleset. A host that filters with iptables and ipset should be configured as an IPSet knoc instead. See the backends chapter.

        Back to top