Zrok Agent Fails to Restart Share on Computer Restart Using Windows Service with NSSM

zrok
1

I can create a share accessible to public Internet, but restarting the computer does not restart the share as I would expect. I think it's trying to start a new share on the same name and facing a name conflict rather than restarting the same share.

I'm using the zrok2 agent running as a Windows 11 service installed via NSSM. The following commands properly create a share accessible at https://dsmainsitenew.shares.zrok.io/ ...

docker build -t mainsitenew .
docker run -dp 127.0.0.1:5000:5000 --restart unless-stopped mainsitenew
zrok2 share public localhost:5000 -n public:dsmainsitenew

After the initial share, zrok2 agent status properly returns...

SHARES
╭──────────────┬────────────┬──────────────┬──────────────────────────────┬───────────────────────┬────────╮
│ SHARE TOKEN  │ SHARE MODE │ BACKEND MODE │ FRONTEND ENDPOINTS           │ TARGET                │ STATUS │
├──────────────┼────────────┼──────────────┼──────────────────────────────┼───────────────────────┼────────┤
│ abd10oxixo85 │ public     │ proxy        │ dsmainsitenew.shares.zrok.io │ http://localhost:5000 │ active │
╰──────────────┴────────────┴──────────────┴──────────────────────────────┴───────────────────────┴────────╯

...and zrok2 list shares properly returns...

╭──────────────┬──────────────────────────────┬────────────┬────────┬─────────┬───────────────────────┬─────────┬─────────────────────╮
│ SHARE TOKEN  │ FRONTEND ENDPOINTS           │ ENV        │ MODE   │ BACKEND │ TARGET                │ LIMITED │ CREATED             │
├──────────────┼──────────────────────────────┼────────────┼────────┼─────────┼───────────────────────┼─────────┼─────────────────────┤
│ abd10oxixo85 │ dsmainsitenew.shares.zrok.io │ VH36cX-o7Z │ public │ proxy   │ http://localhost:5000 │         │ 2026-07-03 10:35:18 │
╰──────────────┴──────────────────────────────┴────────────┴────────┴─────────┴───────────────────────┴─────────┴─────────────────────╯

total: 1 share(s)

However, after restarting the computer (which hosts zrok2 agent and mainsitenew docker application container): 1) the link goes dead, 2) zrok2 agent status shows error state...

SHARES
╭──────────────┬────────────┬──────────────┬────────────────────┬───────────────────────┬──────────╮
│ SHARE TOKEN  │ SHARE MODE │ BACKEND MODE │ FRONTEND ENDPOINTS │ TARGET                │ STATUS   │
├──────────────┼────────────┼──────────────┼────────────────────┼───────────────────────┼──────────┤
│ err_wV41Uu6p │ public     │ proxy        │                    │ http://localhost:5000 │ retrying │
╰──────────────┴────────────┴──────────────┴────────────────────┴───────────────────────┴──────────╯
0 active, 1 retrying, 0 failed

...and 3) zrok2 list shares shows a different error token...

╭──────────────┬──────────────────────────────┬────────────┬────────┬─────────┬───────────────────────┬─────────┬─────────────────────╮
│ SHARE TOKEN  │ FRONTEND ENDPOINTS           │ ENV        │ MODE   │ BACKEND │ TARGET                │ LIMITED │ CREATED             │
├──────────────┼──────────────────────────────┼────────────┼────────┼─────────┼───────────────────────┼─────────┼─────────────────────┤
│ abd10oxixo85 │ dsmainsitenew.shares.zrok.io │ VH36cX-o7Z │ public │ proxy   │ http://localhost:5000 │         │ 2026-07-03 10:35:18 │
╰──────────────┴──────────────────────────────┴────────────┴────────┴─────────┴───────────────────────┴─────────┴─────────────────────╯

total: 1 share(s)

Troubleshooting:

  1. $env:USERPROFILE is set correctly via $env:USERPROFILE = 'c:\Windows\System32\config\systemprofile'
  2. The agent seems to be running properly:
Get-Service zrokAgent
Status   Name               DisplayName
------   ----               -----------
Running  zrokAgent          zrokAgent
  1. Docker properly restarts and serves the application on http://localhost:5000
  2. zrok2 agent console brings up a screen that complains "http://localhost:5000 → no frontend endpoints: last error: unable to start share: unable to create share: unable to create share: [POST /share][409] shareConflict "name 'dsmainsitenew' in namespace 'public' is already in use by another share"

#4 biases me to believe there is a bug in zrok2 agent. I would expect it to restart the same share on the same name rather than start a brand new share on the existing name, note the name conflict, and then return error.

Contents of "C:\Windows\System32\config\systemprofile\.zrok2\agent-stderr.log":

{"file":"/home/runner/work/zrok/zrok/agent/proctree/impl_windows.go:29","func":"github.com/openziti/zrok/v2/agent/proctree.StartChild","level":"info","msg":"executing 'C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000'","time":"2026-07-06T11:34:02.096Z"}
{"file":"/home/runner/work/zrok/zrok/agent/proctree/impl_windows.go:29","func":"github.com/openziti/zrok/v2/agent/proctree.StartChild","level":"info","msg":"executing 'C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000'","time":"2026-07-06T11:35:02.768Z"}
{"file":"/home/runner/work/zrok/zrok/agent/proctree/impl_windows.go:29","func":"github.com/openziti/zrok/v2/agent/proctree.StartChild","level":"info","msg":"executing 'C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000'","time":"2026-07-06T11:37:03.838Z"}
{"file":"/home/runner/work/zrok/zrok/agent/proctree/impl_windows.go:29","func":"github.com/openziti/zrok/v2/agent/proctree.StartChild","level":"info","msg":"executing 'C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000'","time":"2026-07-06T11:41:04.402Z"}

Contents of "C:\Windows\System32\config\systemprofile\.zrok2\agent-stdout.log":

{"time":"2026-07-06T11:34:02.0908067-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).Run","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":59},"msg":"started"}
{"time":"2026-07-06T11:34:02.0908067-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).manager","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":364},"msg":"started"}
{"time":"2026-07-06T11:34:02.0908067-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).gateway","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":338},"msg":"started"}
{"time":"2026-07-06T11:34:02.0908067-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).run","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":103},"msg":"started"}
{"time":"2026-07-06T11:34:02.096255-06:00","level":"WARN","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).remoteAgent","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":308},"msg":"unable to load agent enrollment: open C:\\WINDOWS\\system32\\config\\systemprofile\\.zrok2\\agent-enrollment.json: The system cannot find the file specified."}
{"time":"2026-07-06T11:34:02.096255-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).ReloadRegistry","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":139},"msg":"loaded 0 private accesses"}
{"time":"2026-07-06T11:34:02.096255-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).ReloadRegistry","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":170},"msg":"loaded 1 public shares"}
{"time":"2026-07-06T11:34:02.096255-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":65},"msg":"executing '[C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000]'"}
{"time":"2026-07-06T11:34:02.762809-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":81},"msg":"error joining: exit status 1"}
{"time":"2026-07-06T11:34:02.762809-06:00","level":"WARN","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).ReloadRegistry","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":179},"msg":"failed to restart public share 'http://localhost:5000': unable to start share: unable to create share: unable to create share: [POST /share][409] shareConflict \"name 'dsmainsitenew' in namespace 'public' is already in use by another share\" (will retry)"}
{"time":"2026-07-06T11:34:02.762809-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).ReloadRegistry","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":196},"msg":"next retry for public share 'http://localhost:5000' scheduled for 2026-07-06T11:35:02-06:00"}
{"time":"2026-07-06T11:34:02.762809-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).ReloadRegistry","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":200},"msg":"loaded 0 private shares"}
{"time":"2026-07-06T11:34:02.762809-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).run","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":133},"msg":"added share with id 'err_wV41Uu6p'"}
{"time":"2026-07-06T11:34:02.7633429-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).ReloadRegistry","file":"/home/runner/work/zrok/zrok/agent/agent.go","line":237},"msg":"reload complete"}
{"time":"2026-07-06T11:35:02.7684355-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":65},"msg":"executing '[C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000]'"}
{"time":"2026-07-06T11:35:03.8265189-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":81},"msg":"error joining: exit status 1"}
{"time":"2026-07-06T11:35:03.8265189-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).retry","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":216},"msg":"failed to restart public share 'err_wV41Uu6p': unable to start share: unable to create share: unable to create share: [POST /share][409] shareConflict \"name 'dsmainsitenew' in namespace 'public' is already in use by another share\""}
{"time":"2026-07-06T11:35:03.8265189-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).retry","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":232},"msg":"next retry for public share 'err_wV41Uu6p' scheduled for '2026-07-06 11:37:03.8265189 -0600 MDT m=+182.667983201'"}
{"time":"2026-07-06T11:37:03.8381777-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":65},"msg":"executing '[C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000]'"}
{"time":"2026-07-06T11:37:04.3831874-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":81},"msg":"error joining: exit status 1"}
{"time":"2026-07-06T11:37:04.3831874-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).retry","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":216},"msg":"failed to restart public share 'err_wV41Uu6p': unable to start share: unable to create share: unable to create share: [POST /share][409] shareConflict \"name 'dsmainsitenew' in namespace 'public' is already in use by another share\""}
{"time":"2026-07-06T11:37:04.3831874-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).retry","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":232},"msg":"next retry for public share 'err_wV41Uu6p' scheduled for '2026-07-06 11:41:04.3831874 -0600 MDT m=+423.224651701'"}
{"time":"2026-07-06T11:41:04.4021822-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":65},"msg":"executing '[C:\\Program Files\\zrok2\\zrok2.exe share public --subordinate -b proxy --name-selection public:dsmainsitenew http://localhost:5000]'"}
{"time":"2026-07-06T11:41:04.9099856-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*Agent).SharePublic","file":"/home/runner/work/zrok/zrok/agent/sharePublic.go","line":81},"msg":"error joining: exit status 1"}
{"time":"2026-07-06T11:41:04.9099856-06:00","level":"ERROR","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).retry","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":216},"msg":"failed to restart public share 'err_wV41Uu6p': unable to start share: unable to create share: unable to create share: [POST /share][409] shareConflict \"name 'dsmainsitenew' in namespace 'public' is already in use by another share\""}
{"time":"2026-07-06T11:41:04.9099856-06:00","level":"INFO","source":{"function":"github.com/openziti/zrok/v2/agent.(*retryManager).retry","file":"/home/runner/work/zrok/zrok/agent/retry.go","line":232},"msg":"next retry for public share 'err_wV41Uu6p' scheduled for '2026-07-06 11:49:04.9099856 -0600 MDT m=+903.751449901'"}

Using zrok2 version v2.0.4 [6ff92039].

Can anyone suggest:

  1. Further troubleshooting steps
  2. Possible configuration problems
  3. Further logs or diagnostics to post
  4. A bug report be opened

Thanks!
Matt

2

The problem is that your agent is not shutting down cleanly. When the agent shuts down it removes the share from your namespace name. That share needs to be removed before it can start a new one using that same name, which is what causes the 409 error you're seeing.

You can just zrok delete share the share token that's attached to your namespace name, and your agent can re-start the share properly.

If you skip NSSM and just run zrok2 agent start in a terminal window and hit CTRL-C to terminate it (once it's up and running), you should see the agent remove the share from your name, and subsequent runs of zrok2 agent start should start normally. You want to figure out how to configure NSSM to do the same thing that's happening in your terminal window when you hit CTRL-C.

Sometimes when zrok2 agent start is hosted in things like NSSM or docker containers, the shutdown hook is not invoked properly (the process isn't terminated using the appropriate signal) and shares are not cleaned up.