{"record":{"id":"24ba44eb2f3cf484","repo":"hashicorp/nomad","slug":"running-container-as-containeradmin-is-unsafe-cha","errorCode":null,"errorMessage":"running container as ContainerAdmin is unsafe; change the container user, set task configuration to privileged or enable windows_allow_insecure_container_admin to disable this check","messagePattern":"running container as ContainerAdmin is unsafe; change the container user, set task configuration to privileged or enable windows_allow_insecure_container_admin to disable this check","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver_windows.go","lineNumber":30,"sourceCode":")\n\n// Currently Windows containers don't support host ip in port binding.\nfunc getPortBinding(ip string, port string) nat.PortBinding {\n\treturn nat.PortBinding{HostIP: \"\", HostPort: port}\n}\n\nvar containerAdminErrMsg = \"running container as ContainerAdmin is unsafe; change the container user, set task configuration to privileged or enable windows_allow_insecure_container_admin to disable this check\"\n\nfunc validateImageUser(user, taskUser string, taskDriverConfig *TaskConfig, driverConfig *DriverConfig) error {\n\t// we're only interested in the case where isolation is set to \"process\"\n\t// (it's also the default) and when windows_allow_insecure_container_admin\n\t// is explicitly set to true in the config\n\tif driverConfig.WindowsAllowInsecureContainerAdmin || taskDriverConfig.Isolation == \"hyper-v\" {\n\t\treturn nil\n\t}\n\n\tif user == \"ContainerAdmin\" && (taskUser == \"ContainerAdmin\" || taskUser == \"\") && !taskDriverConfig.Privileged {\n\t\treturn errors.New(containerAdminErrMsg)\n\t}\n\treturn nil\n}\n","sourceCodeStart":12,"sourceCodeEnd":34,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver_windows.go#L12-L34","documentation":"The Nomad Docker driver on Windows blocks running a container as ContainerAdmin (or as the default user when that resolves to ContainerAdmin) unless the task is explicitly privileged, an hyper-v isolation is used, or windows_allow_insecure_container_admin is set in the driver config. This guards against containers escaping isolation via administrator privileges on Windows hosts.","triggerScenarios":"Starting a Docker task on Windows where the image's default user or the task's `user` field is ContainerAdmin, task config `privileged` is false, isolation is not hyper-v, and the driver option windows_allow_insecure_container_admin is not true — detected in validateImageUser during task validation/start.","commonSituations":"Windows images (e.g. nanoserver/servercore variants) that default to ContainerAdmin; jobs migrated from Linux where root defaults were fine; upgrading Nomad after the safety check was introduced.","solutions":["Set a non-admin user in the task config: user = \"ContainerUser\" (or use an image whose default user is not ContainerAdmin)","Set task driver config privileged = true if admin rights are genuinely required","Use isolation = \"hyper-v\" in the task config","Explicitly accept the risk with the driver option windows_allow_insecure_container_admin = true in the client config"],"exampleFix":"// before\ntask \"app\" {\n  driver = \"docker\"\n  config { image = \"mcr.microsoft.com/windows/servercore:ltsc2022\" }\n}\n// after\ntask \"app\" {\n  driver = \"docker\"\n  user = \"ContainerUser\"\n  config { image = \"mcr.microsoft.com/windows/servercore:ltsc2022\" }\n}","handlingStrategy":"validation","validationCode":"user := task.User\nif user == \"\" { user = imageDefaultUser } // e.g. ContainerAdmin for many Windows images\ninsecure := driverConfig.WindowsAllowInsecureContainerAdmin\nprivileged := taskCfg.Privileged\nif user == \"ContainerAdmin\" && !privileged && taskCfg.Isolation != \"hyper-v\" && !insecure {\n    return fmt.Errorf(\"task would run as ContainerAdmin; set user=ContainerUser, privileged, hyper-v isolation, or windows_allow_insecure_container_admin\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Explicitly set user = \"ContainerUser\" for Windows Docker tasks","Audit Windows images for ContainerAdmin defaults before deploying","Prefer hyper-v isolation for workloads that need elevated rights","Avoid windows_allow_insecure_container_admin unless the risk is accepted"],"tags":["nomad","docker","windows","security","container-admin"],"backgroundTag":"insecure-container-user","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}