{"record":{"id":"466b71615855b090","repo":"hashicorp/nomad","slug":"running-as-gid-d-is-disallowed","errorCode":null,"errorMessage":"running as gid %d is disallowed","messagePattern":"running as gid (.+?) is disallowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/validators/validators.go","lineNumber":93,"sourceCode":"\tuid, err := getUserID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator: %w\", err)\n\t}\n\n\t// check uids\n\tif v.deniedUIDs.Contains(uid) {\n\t\treturn fmt.Errorf(\"running as uid %d is disallowed\", uid)\n\t}\n\n\tgids, err := getGroupsID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator:  %w\", err)\n\t}\n\n\t// check gids\n\tfor _, gid := range gids {\n\t\tif v.deniedGIDs.Contains(gid) {\n\t\t\treturn fmt.Errorf(\"running as gid %d is disallowed\", gid)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateIDRange is used to ensure that the configuration for ID ranges is valid\n// by checking the syntax and bounds.\nfunc validateIDRange(rangeType string, deniedRanges string) error {\n\n\tparts := strings.Split(deniedRanges, \",\")\n\n\t// exit early if empty string\n\tif len(parts) == 1 && parts[0] == \"\" {\n\t\treturn nil\n\t}\n\n\tfor _, rangeStr := range parts {","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/validators/validators.go#L75-L111","documentation":"HasValidIDs checks each of the user's group IDs against the deniedGIDs set configured on the client. This error means at least one of the task user's groups (primary or supplementary) falls in a forbidden GID range, blocking the task as a security measure against privileged group membership (e.g. docker, sudo, disk groups).","triggerScenarios":"A task runs as a user who is a member of a protected group (e.g. gid 0/root, docker, sudo, video) while the client config specifies denied_host_gids ranges; validation happens at task start on the client.","commonSituations":"User added to a sensitive group (docker/wheel) for other purposes, then denied for Nomad tasks; job migrated to a cluster with stricter GID policy; LDAP group membership expanding the user's groups beyond local ones.","solutions":["Remove the user from the denied group (gpasswd -d <user> <group> or edit group membership)","Create a dedicated task user with membership only in benign groups","If membership is required, ask the operator to adjust the denied_host_gids policy","Check supplementary groups with id <user> to identify which GID triggered the denial"],"exampleFix":"// before: task user in docker group (denied gid 999)\n// usermod -aG docker taskuser\n// after: remove from denied group\n// gpasswd -d taskuser docker","handlingStrategy":"validation","validationCode":"u, err := user.Lookup(userName)\nif err != nil { return err }\nfor _, gidStr := range mustGroupIds(u) {\n    gid, _ := strconv.Atoi(gidStr)\n    if deniedGIDs.Contains(gid) {\n        return fmt.Errorf(\"user %q is in denied group (gid %d); remove membership\", userName, gid)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run tasks under dedicated users with no sensitive group memberships (docker, sudo, wheel)","Audit group membership whenever users are modified on client hosts","Document denied_host_gids ranges for job authors","Check id <user> output before onboarding a user for task workloads"],"tags":["security","gid","policy","validation"],"backgroundTag":"gid-denied-by-policy","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}