Skip to main content

NFT001 - Agent Cannot Run nft

Agent error code #NFT001 indicates that nft is present on the host but the agent has no way to run it with the privileges it needs. Changing the kernel ruleset requires root, and the agent is neither running as root nor able to escalate.

The agent never hardcodes sudo. When it is not root it looks for a non-interactive escalation tool, preferring doas -n on OpenBSD (where sudo is not in base) and sudo -n everywhere else. This code means neither binary was found at all.

A sudoers or doas rule that exists but refuses the call is a different failure. There the escalation tool runs and nft does not, and the agent reports #NFT400, because from the outside a refusal and a broken nft look the same. Read that page if sudo is installed and this code still appears.

Common causes include:

  • The agent runs as a non-root service account on a host with neither sudo nor doas installed
  • sudo is installed outside the PATH the agent process was started with
  • The agent runs in a container image stripped down to the agent binary

Steps to Resolve

Let knocker Configure It

On the agent host:

knocker enable nftables
knocker status nftables

enable writes /etc/sudoers.d/knocknoc-agent_nftables, validates it with visudo -cf, creates the default sets and installs the unit that recreates them at boot. status reports whether the agent has the permission.

Or Grant Access by Hand

  1. Confirm sudo is installed and on the agent's PATH: command -v sudo
  2. Create /etc/sudoers.d/knocknoc-agent_nftables with the rule the package ships:
knocknoc-agent ALL=(ALL) NOPASSWD: /usr/sbin/nft, /sbin/nft
  1. Set its mode to 440 and validate it: sudo visudo -cf /etc/sudoers.d/knocknoc-agent_nftables
  2. Confirm one of the two paths in the rule matches command -v nft exactly. A rule naming /sbin/nft does not authorize /usr/sbin/nft

Verify From the Agent's Own Account

Run the check as the service account rather than as yourself:

sudo -l -U knocknoc-agent | grep nft
sudo -u knocknoc-agent sudo -n nft --version

A password prompt, or a message that a password is required, means the rule is not taking effect for that account.

Or Run the Agent as Root

If your deployment model allows it, running the agent as root removes the escalation step entirely.

Back to top