{"record":{"id":"48359d01ea3a7b94","repo":"hashicorp/nomad","slug":"allow-caps-configured-with-capabilities-not-suppor-48359d","errorCode":null,"errorMessage":"allow_caps configured with capabilities not supported by system: %s","messagePattern":"allow_caps configured with capabilities not supported by system: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/java/driver.go","lineNumber":157,"sourceCode":"\tAllowCaps []string `codec:\"allow_caps\"`\n}\n\nfunc (c *Config) validate() error {\n\tswitch c.DefaultModePID {\n\tcase executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"default_pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)\n\t}\n\n\tswitch c.DefaultModeIPC {\n\tcase executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"default_ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)\n\t}\n\n\tbadCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))\n\tif !badCaps.Empty() {\n\t\treturn fmt.Errorf(\"allow_caps configured with capabilities not supported by system: %s\", badCaps)\n\t}\n\n\treturn nil\n}\n\n// TaskConfig is the driver configuration of a taskConfig within a job\ntype TaskConfig struct {\n\t// Class indicates which class contains the java entry point.\n\tClass string `codec:\"class\"`\n\n\t// ClassPath indicates where class files are found.\n\tClassPath string `codec:\"class_path\"`\n\n\t// JarPath indicates where a jar  file is found.\n\tJarPath string `codec:\"jar_path\"`\n\n\t// JvmOpts are arguments to pass to the JVM\n\tJvmOpts []string `codec:\"jvm_options\"`","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/java/driver.go#L139-L175","documentation":"After validating pid/ipc modes, Config.validate() diffs the configured allow_caps list against the capability set the system actually supports (capabilities.Supported()). If any configured capability is unsupported on this host, the driver setup fails with this error listing the bad capabilities.","triggerScenarios":"allow_caps in the java driver plugin config contains Linux capabilities not present in the host kernel's supported set.","commonSituations":"Config copied from a newer kernel host to an older one; typos in capability names (e.g. \"SYS_ADMINX\"); running Nomad inside a container with a reduced capability bounding set.","solutions":["Remove or correct the unsupported capabilities listed in the error message.","Run `capsh --print` or check the kernel to see which capabilities the host supports.","If the capability is genuinely needed, upgrade the host kernel or run Nomad outside the restricting container.","Use `nomad agent validate` or the `nomad plugin status` output to confirm the allowed set."],"exampleFix":"// before\nplugin \"java\" {\n  allow_caps = [\"net_admin\", \"sys_time\", \"bogus_cap\"]\n}\n// after\nplugin \"java\" {\n  allow_caps = [\"net_admin\", \"sys_time\"]\n}","handlingStrategy":"validation","validationCode":"supported := map[string]bool{\"chown\": true, \"dac_override\": true, \"fowner\": true /* ...discover via capabilities.Supported() */}\nfor _, c := range allowCaps {\n    if !supported[c] {\n        return fmt.Errorf(\"capability %q not supported on this host\", c)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := driver.SetConfig(cfg); err != nil && strings.Contains(err.Error(), \"allow_caps\") {\n    return fmt.Errorf(\"remove unsupported capabilities from allow_caps: %w\", err)\n}","preventionTips":["Enumerate host capabilities (capsh --print) before configuring allow_caps.","Keep allow_caps minimal and host-specific.","Remember Nomad-in-container may have a reduced capability set."],"tags":["java-driver","capabilities","config-validation","nomad"],"backgroundTag":"unsupported-capability","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}