Skip to main content

NFT001 - Agent Cannot Run nft

Agent error code #NFT001 indicates that nft is present on the host but the agent has no way to run it with the privileges it needs. Modifying the kernel ruleset requires root, and the agent is neither running as root nor able to escalate.

The agent never hardcodes sudo. When it is not root it looks for a non-interactive escalation tool, preferring doas -n where that is the platform convention and otherwise sudo -n. This error means neither was usable.

Common causes include:

  • The agent runs as a non-root service account and no sudoers or doas rule grants it nft
  • A sudoers rule exists but requires a password, so the non-interactive call fails
  • A sudoers rule exists but is scoped to a different user, command path or host

Steps to Resolve

Grant the Agent Non-Interactive Access to nft

  1. Create a drop-in file, for example /etc/sudoers.d/knocknoc-agent
  2. Add a rule for the account the agent runs as, with no password prompt:
knocknoc ALL=(root) NOPASSWD: /usr/sbin/nft
  1. Validate the file before relying on it: sudo visudo -c -f /etc/sudoers.d/knocknoc-agent
  2. Confirm the path in the rule matches command -v nft exactly. A rule naming /sbin/nft does not authorize /usr/sbin/nft

Verify From the Agent's Own Account

Run the check as the service account rather than as yourself:

sudo -u knocknoc sudo -n nft --version

A password prompt or a "sorry, a password is required" message means the rule is not taking effect.

On OpenBSD, Use doas

sudo is not in the OpenBSD base system. Add the equivalent rule to /etc/doas.conf and confirm it with doas -n nft --version.

Or Run the Agent as Root

If your deployment model allows it, running the agent as root removes the escalation step entirely.

Back to top