{"record":{"id":"2a7a9fa226817cea","repo":"hashicorp/nomad","slug":"unable-to-start-validator-w-2a7a9f","errorCode":null,"errorMessage":"unable to start validator: %w","messagePattern":"unable to start validator: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/rawexec/driver.go","lineNumber":248,"sourceCode":"}\n\nfunc (d *Driver) ConfigSchema() (*hclspec.Spec, error) {\n\treturn configSpec, nil\n}\n\nfunc (d *Driver) SetConfig(cfg *base.Config) error {\n\tvar config Config\n\n\tif len(cfg.PluginConfig) != 0 {\n\t\tif err := base.MsgPackDecode(cfg.PluginConfig, &config); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tif d.userIDValidator == nil {\n\t\tidValidator, err := validators.NewValidator(d.logger, config.DeniedHostUids, config.DeniedHostGids)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to start validator: %w\", err)\n\t\t}\n\n\t\td.userIDValidator = idValidator\n\t}\n\n\td.config = &config\n\n\tif cfg.AgentConfig != nil {\n\t\td.nomadConfig = cfg.AgentConfig.Driver\n\t\td.compute = cfg.AgentConfig.Compute()\n\t}\n\n\treturn nil\n}\n\nfunc (d *Driver) TaskConfigSchema() (*hclspec.Spec, error) {\n\treturn taskConfigSpec, nil\n}","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/rawexec/driver.go#L230-L266","documentation":"SetConfig constructs a userID validator from DeniedHostUids/DeniedHostGids when none exists yet, and wraps any validator construction failure with this error. It prevents the raw_exec driver from running with a broken/bad user-ID allowlist validator.","triggerScenarios":"Driver SetConfig called with a userIDValidator not yet initialized and validators.NewValidator failing on invalid DeniedHostUids/DeniedHostGids config values.","commonSituations":"Client config with malformed denied UID/GID lists (non-numeric values, parse failures); plugin (re)configuration after agent reload where the validator must be recreated.","solutions":["Fix the DeniedHostUids / DeniedHostGids values in the client plugin config (must be valid numeric ID lists)","Inspect the wrapped %w cause in the error/client logs for the exact parse failure","Restart the Nomad client after correcting the config so SetConfig reruns cleanly"],"exampleFix":"// before (client.hcl)\nplugin \"raw_exec\" {\n  config {\n    denied_host_uids = \"root, admin\" # invalid: non-numeric\n  }\n}\n// after\nplugin \"raw_exec\" {\n  config {\n    denied_host_uids = \"0,1\"\n    denied_host_gids = \"0,1\"\n  }\n}","handlingStrategy":"validation","validationCode":"// pre-validate denied UID/GID lists before SetConfig\nfor _, s := range strings.Split(deniedUids, \",\") {\n    if _, err := strconv.Atoi(strings.TrimSpace(s)); err != nil {\n        return fmt.Errorf(\"invalid denied_host_uid %q\", s)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := drv.SetConfig(cfg); err != nil && strings.Contains(err.Error(), \"unable to start validator\") {\n    // inspect wrapped cause; fix denied_host_uids/gids config\n}","preventionTips":["Use numeric UIDs/GIDs only in denied lists","Test client config with `nomad agent -config ... -verify` style dry runs","Log the wrapped %w cause for diagnosis"],"tags":["raw-exec","config","validator","nomad-driver"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}