{"record":{"id":"1f32abef6710c9c4","repo":"hashicorp/nomad","slug":"disable-filesystem-isolation-must-be-set","errorCode":null,"errorMessage":"disable_filesystem_isolation must be set","messagePattern":"disable_filesystem_isolation must be set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/config/artifact.go","lineNumber":241,"sourceCode":"\tif v := *a.DecompressionFileCountLimit; v < 0 {\n\t\treturn fmt.Errorf(\"decompression_file_count_limit must be >= 0 but found %d\", v)\n\t}\n\n\tif a.DecompressionSizeLimit == nil {\n\t\treturn fmt.Errorf(\"decompression_size_limit must not be nil\")\n\t}\n\tif v, err := humanize.ParseBytes(*a.DecompressionSizeLimit); err != nil {\n\t\treturn fmt.Errorf(\"decompression_size_limit is not a valid size: %w\", err)\n\t} else if v > math.MaxInt64 {\n\t\treturn fmt.Errorf(\"decompression_size_limit must be < %d but found %d\", int64(math.MaxInt64), v)\n\t}\n\n\tif a.DisableArtifactInspection == nil {\n\t\treturn fmt.Errorf(\"disable_artifact_inspection must be set\")\n\t}\n\n\tif a.DisableFilesystemIsolation == nil {\n\t\treturn fmt.Errorf(\"disable_filesystem_isolation must be set\")\n\t}\n\n\tfor _, p := range a.FilesystemIsolationExtraPaths {\n\t\tif _, err := landlock.ParsePath(p); err != nil {\n\t\t\treturn fmt.Errorf(\"filesystem_isolation_extra_paths contains invalid lockdown path %q\", p)\n\t\t}\n\t}\n\n\tif a.SetEnvironmentVariables == nil {\n\t\treturn fmt.Errorf(\"set_environment_variables must be set\")\n\t}\n\n\treturn nil\n}\n\nfunc DefaultArtifactConfig() *ArtifactConfig {\n\treturn &ArtifactConfig{\n\t\t// Read timeout for HTTP operations. Must be long enough to","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/config/artifact.go#L223-L259","documentation":"ArtifactConfig.Validate requires every nullable boolean knob to be explicitly set so that agent configs always state their intent. If DisableArtifactInspection is a nil *bool, validation fails with this message. Nomad deliberately forces explicit true/false rather than guessing a default.","triggerScenarios":"Calling Validate() on an ArtifactConfig built from a partial config (e.g. JSON/HCL that omitted the disable_artifact_inspection key) leaves the pointer nil and triggers the error.","commonSituations":"Hand-written agent config files missing the field; upgrading Nomad after new required artifact fields were added; programmatically constructing ArtifactConfig{} without initializing all pointer fields.","solutions":["Add disable_artifact_inspection = true/false to the artifact block in your agent config","If constructing in Go, set DisableArtifactInspection: pointerOf(bool) to an explicit value before calling Validate","Start from DefaultArtifactConfig() and override only what you need"],"exampleFix":"// before\nartifact {\n  disable_filesystem_isolation = false\n}\n// after\nartifact {\n  disable_artifact_inspection = false\n  disable_filesystem_isolation = false\n}","handlingStrategy":"validation","validationCode":"if cfg.Artifact != nil && cfg.Artifact.DisableArtifactInspection == nil {\n    return errors.New(\"artifact block must set disable_artifact_inspection explicitly\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Seed artifact config from DefaultArtifactConfig() and only override fields","Keep agent configs complete when upgrading Nomad versions; run nomad agent validate first","Treat all nullable *bool config knobs as required"],"tags":["config","validation","nomad-agent"],"backgroundTag":"missing-required-config-field","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}