{"record":{"id":"2d0fbc2eef251d75","repo":"hashicorp/nomad","slug":"unable-to-find-nobody-user-w","errorCode":null,"errorMessage":"Unable to find nobody user: %w","messagePattern":"Unable to find nobody user: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocdir/fs_unix.go","lineNumber":48,"sourceCode":"\t// secrets directory\n\tTaskSecretsContainerPath = filepath.Join(\"/\", TaskSecrets)\n)\n\n// dropDirPermissions gives full access to a directory to all users and sets\n// the owner to nobody.\nfunc dropDirPermissions(path string, desired os.FileMode) error {\n\tif err := os.Chmod(path, desired|fileMode777); err != nil {\n\t\treturn fmt.Errorf(\"Chmod(%v) failed: %w\", path, err)\n\t}\n\n\t// Can't change owner if not root.\n\tif unix.Geteuid() != 0 {\n\t\treturn nil\n\t}\n\n\tu, err := users.Lookup(\"nobody\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Unable to find nobody user: %w\", err)\n\t}\n\n\tuid, err := getUid(u)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tgid, err := getGid(u)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := os.Chown(path, uid, gid); err != nil {\n\t\treturn fmt.Errorf(\"Couldn't change owner/group of %v to (uid: %v, gid: %v): %w\", path, uid, gid, err)\n\t}\n\n\treturn nil\n}","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocdir/fs_unix.go#L30-L66","documentation":"After relaxing directory permissions, dropDirPermissions (only when running as root, euid==0) tries to chown the directory to the 'nobody' user via users.Lookup(\"nobody\"). This error means the 'nobody' account could not be resolved through the system user database, so the ownership downgrade could not be performed.","triggerScenarios":"unix.Geteuid()==0 and users.Lookup(\"nobody\") failed — the 'nobody' user is absent from /etc/passwd or any configured NSS source during allocation directory setup.","commonSituations":"Minimal container images (scratch/distroless) lacking the nobody entry; broken /etc/passwd or NSS configuration (missing libnss files); hosts where the distro names the account differently (e.g. 'nogroup' concerns, or nobody removed for hardening).","solutions":["Ensure the 'nobody' user exists: verify `getent passwd nobody` returns an entry.","Add nobody to /etc/passwd (e.g. nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin) in minimal images.","Fix NSS configuration if user lookup is delegated to LDAP/SSSD and currently failing.","Upgrade/repair the base image of the Nomad client host or container."],"exampleFix":"// before: scratch-based client image with no /etc/passwd entry\nFROM scratch\n// after: ensure nobody exists\nFROM alpine:3\nRUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' >> /etc/passwd","handlingStrategy":"validation","validationCode":"// host preflight (run at client bootstrap)\nif _, err := user.Lookup(\"nobody\"); err != nil {\n    return fmt.Errorf(\"host missing 'nobody' user required by nomad: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := td.Build(); err != nil {\n    if strings.Contains(err.Error(), \"Unable to find nobody user\") {\n        log.Printf(\"client host lacks nobody account; fix /etc/passwd or base image\")\n    }\n    return err\n}","preventionTips":["Include a standard /etc/passwd with nobody in minimal container images.","Add a host preflight check before registering the client.","Keep NSS configuration simple and functional on client hosts."],"tags":["permissions","users","linux","nomad"],"backgroundTag":"user-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}