netavark: host netlink socket: IO error: Protocol not available (os error 92)

[hustler-not-chatty]

Steps to reproduce:

podman network create
podman1
podman run -it alpine:3.22 sh # this works fine
/ #
podman run --network podman1 -it alpine:3.22 sh
Error: netavark (exit code 1): host netlink socket: IO error: Protocol not available (os error 92)

podman info:

host:
  arch: arm64
  buildahVersion: 1.43.0
  cgroupControllers: []
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon_2.2.1-2_arm64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: c8cc2c4db27531bd4e084ce7857f73cd21ee639d'
  cpuUtilization:
    idlePercent: 98.89
    systemPercent: 0.63
    userPercent: 0.48
  cpus: 8
  databaseBackend: sqlite
  distribution:
    codename: kylin
    distribution: kylin
    version: v10
  eventLogger: journald
  freeLocks: 2026
  hostname: boss-W515-ZZ
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 4.19.71-45-kr990
  linkmode: dynamic
  logDriver: journald
  memFree: 3532685312
  memTotal: 8124076032
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns_1.17.0-2_arm64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.17.0
    package: netavark_1.17-2_arm64
    path: /usr/libexec/podman/netavark
    version: netavark 1.17.2
  ociRuntime:
    name: crun
    package: crun_1.26-4_arm64
    path: /usr/bin/crun
    version: |-
      crun version 1.26-dirty
      commit: 3241e671f92c33b0c003cd7de319e4f32add6231
      rundir: /run/user/1001/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_2026-01-20.386b5f5-2_arm64
    version: |
      pasta 2026_01_20.386b5f5
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1001/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 3221221376
  swapTotal: 3221221376
  uptime: 1h 23m 47.00s (Approximately 0.04 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  docker.io:
    Blocked: false
    Insecure: true
    Location: registry-1.docker.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: docker.1panel.live
      PullFromMirror: ""
    - Insecure: false
      Location: docker.1ms.run
      PullFromMirror: ""
    - Insecure: false
      Location: docker.xuanyuan.me
      PullFromMirror: ""
    Prefix: docker.io
    PullFromMirror: ""
  gcr.io:
    Blocked: false
    Insecure: true
    Location: gcr.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: gcr.1ms.run
      PullFromMirror: ""
    Prefix: gcr.io
    PullFromMirror: ""
  ghcr.io:
    Blocked: false
    Insecure: true
    Location: ghcr.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: ghcr.1ms.run
      PullFromMirror: ""
    Prefix: ghcr.io
    PullFromMirror: ""
  k8s.gcr.io:
    Blocked: false
    Insecure: true
    Location: k8s.gcr.io
    MirrorByDigestOnly: false
    Mirrors:
    - Insecure: false
      Location: k8s.1ms.run
      PullFromMirror: ""
    Prefix: k8s.gcr.io
    PullFromMirror: ""
  search:
  - docker.io
  - k8s.gcr.io
  - gcr.io
store:
  configFile: /home/boss-bg/.config/containers/storage.conf
  containerStore:
    number: 14
    paused: 0
    running: 0
    stopped: 14
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/boss-bg/.local/share/containers/storage
  graphRootAllocated: 160842354688
  graphRootUsed: 37111435264
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 11
  runRoot: /run/user/1001/containers
  transientStore: false
  volumePath: /home/boss-bg/.local/share/containers/storage/volumes
version:
  APIVersion: 5.8.0
  Built: 1774446983
  BuiltTime: Wed Mar 25 21:56:23 2026
  GitCommit: 07efc23e05c3d9aa15a0f30d57194737bfc4b6b1
  GoVersion: go1.25.8
  Os: linux
  OsArch: linux/arm64
  Version: 5.8.0

[Luap99]

4.19.71-45-kr990

That looks like a really old custom kernel? I suggest you try something newer or is it possible that your kernel has not netlink route support?

Feel free to strace the process but this just looks like an EPROTONOSUPPORT error on the socket call which does not seem like a netavark problem at all.

[hustler-not-chatty]

That looks like a really old custom kernel? I suggest you try something newer or is it possible that your kernel has not netlink route support?

Unfortunately, this is the only kernel that works on this particular machine.

Looks like the only way out is to downgrade netavark?

[Luap99]

Looks like the only way out is to downgrade netavark?

Did netavark ever work on that machine with that kernel?

We always depended on proper netlink route support and some other netlink protocols so if this is related to some nv update you should git bisect I guess and then we can see what is going on.

But overall we have no formal kernel support policy and IMO 4.X is just to old to support so I do not really care to that, AFAIK even many podman features need newer things now from 5.X kernels.

[hustler-not-chatty]

Did netavark ever work on that machine with that kernel?

Just downgraded it to 1.15.2, worked as expected.

[hustler-not-chatty]

Turns out, this patch uses NETLINK_GET_STRICT_CHK, which is available on Linux 4.20+.

Should we document this as a kernel requirement?

[Luap99]

The problem with such doc is they become stale quickly, we have no way to test a minimum kernel version as part of CI.

But sure if I guess saying we need at least 4.20+ to run sounds fair