{"record":{"id":"3ed0da1f8fc02f23","repo":"hashicorp/nomad","slug":"failed-host-user-validation-v","errorCode":null,"errorMessage":"failed host user validation: %v","messagePattern":"failed host user validation: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":479,"sourceCode":"\t}\n\n\tvar driverConfig TaskConfig\n\tif err := cfg.DecodeDriverConfig(&driverConfig); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to decode driver config: %v\", err)\n\t}\n\n\tif err := driverConfig.validate(); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed driver config validation: %v\", err)\n\t}\n\n\tif cfg.User == \"\" {\n\t\tcfg.User = \"nobody\"\n\t}\n\n\td.logger.Debug(\"setting up user\", \"user\", cfg.User)\n\n\tif err := d.userIDValidator.HasValidIDs(cfg.User); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed host user validation: %v\", err)\n\t}\n\n\td.logger.Info(\"starting task\", \"driver_cfg\", hclog.Fmt(\"%+v\", driverConfig))\n\thandle = drivers.NewTaskHandle(taskHandleVersion)\n\thandle.Config = cfg\n\n\tpluginLogFile := filepath.Join(cfg.TaskDir().Dir, \"executor.out\")\n\texecutorConfig := &executor.ExecutorConfig{\n\t\tLogFile:     pluginLogFile,\n\t\tLogLevel:    \"debug\",\n\t\tFSIsolation: true,\n\t\tCompute:     d.compute,\n\t}\n\n\tuser := cfg.User\n\tif cfg.DNS != nil {\n\t\tdnsMount, err := resolvconf.GenerateDNSMount(cfg.TaskDir().Dir, cfg.DNS)\n\t\tif err != nil {","sourceCodeStart":461,"sourceCodeEnd":497,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L461-L497","documentation":"StartTask validates that the user the task will run as exists on the host with valid UID/GID via d.userIDValidator.HasValidIDs. exec tasks run as real host users (unlike docker with namespacing), so an unknown or invalid user aborts the launch.","triggerScenarios":"TaskConfig.User names a user missing from /etc/passwd, a user with no valid UID/GID, or an invalid user string when chroot/isolation requires a resolvable host account.","commonSituations":"Job sets user = \"appuser\" but that account exists only in a container image, not on the Nomad host; LDAP-managed accounts not resolvable on the client node; typo'd username.","solutions":["Create the user on the Nomad client host (useradd) or use an existing host account.","Remove the 'user' field from the task to accept the default \"nobody\".","Verify the account resolves with 'id <user>' on the client node.","If using an infrastructure-managed account store, ensure nsswitch/sssd is configured on the client."],"exampleFix":"// before (job spec)\ntask \"web\" {\n  user = \"webapp\" // not a host user\n}\n// after\n# on the Nomad client host:\n# sudo useradd -r webapp\ntask \"web\" {\n  user = \"webapp\"\n}","handlingStrategy":"validation","validationCode":"// ensure the user resolves on the client host before launching\nif out, err := exec.Command(\"id\", user).CombinedOutput(); err != nil {\n    return fmt.Errorf(\"user %q does not exist on host: %s\", user, out)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision task users with config management on every Nomad client.","Prefer existing system accounts or the implicit \"nobody\" default.","Verify NSS/LDAP/SSSD resolution works on client nodes if accounts are centralized.","Run 'id <user>' as part of node readiness checks."],"tags":["nomad","exec-driver","user-validation","linux"],"backgroundTag":"host-user-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}