When working with Linux VServer environments, you might encounter the frustrating error:

$ ping 8.8.8.8
ping: icmp open socket: Operation not permitted

This occurs even when running as root and with proper permissions on the ping binary (shown by the setuid bit -rwsr-xr-x).

The key detail here is that this is happening in a VServer environment. Unlike regular virtualization solutions, VServer implements operating system-level virtualization, which means certain kernel capabilities might be restricted at the container level.

First, verify the capabilities available to your container:

$ cat /proc/self/status | grep Cap
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 0000000000000000

If all capabilities show zeros, your container is running in a highly restricted context.

The most effective solution is to modify the VServer configuration for your container. You'll need root access to the host system:

# On the host system:
vserver your_vserver_name stop
echo "CAP_NET_RAW" >> /etc/vservers/your_vserver_name/flags/capabilities
vserver your_vserver_name start

If you can't modify the VServer configuration, consider using TCP-based alternatives to ping:

$ timeout 1 bash -c "cat < /dev/null > /dev/tcp/8.8.8.8/53" && echo "Connection successful" || echo "Connection failed"

Or using curl for HTTP checks:

$ curl -I --connect-timeout 1 http://8.8.8.8

Check if ICMP is being filtered at the network level:

$ tcpdump -ni any icmp

Run this on both the container and host while attempting to ping to see where packets might be getting dropped.

Some older VServer implementations required specific kernel modules for proper ICMP support. Check if these are loaded:

$ lsmod | grep -E 'vserver|cap'

---

While working in a VServer environment with multiple Linux virtual machines, I encountered a peculiar issue where ping suddenly stopped working on one specific VM while functioning perfectly on others:

$ ping 8.8.8.8
ping: icmp open socket: Operation not permitted

First, I verified all the obvious suspects:

$ ls -l $(which ping)
-rwsr-xr-x 1 root root 30736 2007-01-31 00:10 /bin/ping

$ whoami
root

$ uname -a  
Linux v-web1 2.6.27.55-vs2.3.0.36.9 #1 SMP Tue Apr 28 11:35:00 CEST 2015 i686 GNU/Linux

The SUID bit was properly set, I was running as root, and the binary existed. The kernel version showed this was a Linux-VServer environment.

The key insight came from understanding how Linux-VServer handles network isolation. Unlike full virtualization, VServer uses kernel-level context isolation. The error suggests the VM lacks proper capabilities despite root privileges.

For VServer environments, ICMP ping requires specific context flags. Check your context configuration:

$ cat /etc/vservers/<your-vm-name>/context
CAP_NET_RAW=1
CAP_NET_ADMIN=1

If these capabilities aren't set, create or modify the context file:

# echo "CAP_NET_RAW=1" >> /etc/vservers/<your-vm-name>/context
# echo "CAP_NET_ADMIN=1" >> /etc/vservers/<your-vm-name>/context
# /etc/init.d/vservers restart

If you need a temporary workaround while debugging, you can create a simple ping alternative using raw sockets:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip_icmp.h>

int main() {
    int s = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
    if (s < 0) {
        perror("socket");
        return 1;
    }
    printf("Raw ICMP socket created successfully\n");
    close(s);
    return 0;
}

Sometimes missing kernel modules can cause this issue. Check if the required modules are loaded:

$ lsmod | grep ping
$ lsmod | grep icmp

If they're missing, load them with:

# modprobe ping
# modprobe icmp

For a permanent fix in VServer environments:

1. Ensure proper capabilities in the context file
2. Verify kernel module availability
3. Check for any custom iptables rules blocking ICMP
4. Consider updating VServer tools if this is a recent regression

Remember that VServer's security model intentionally restricts certain operations even to root, so proper capability configuration is essential.