{"record":{"id":"4cfb15bdac1f987e","repo":"hashicorp/nomad","slug":"pid-mode-must-be-q-or-q-got-q","errorCode":null,"errorMessage":"pid_mode must be %q or %q, got %q","messagePattern":"pid_mode must be %q or %q, got %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":223,"sourceCode":"\t// ModeIPC indicates whether IPC namespace isolation is enabled for the task.\n\t// Must be \"private\" or \"host\" if set.\n\tModeIPC string `codec:\"ipc_mode\"`\n\n\t// CapAdd is a set of linux capabilities to enable.\n\tCapAdd []string `codec:\"cap_add\"`\n\n\t// CapDrop is a set of linux capabilities to disable.\n\tCapDrop []string `codec:\"cap_drop\"`\n\n\t// WorkDir is the working directory inside the chroot\n\tWorkDir string `codec:\"work_dir\"`\n}\n\nfunc (tc *TaskConfig) validate() error {\n\tswitch tc.ModePID {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)\n\t}\n\n\tswitch tc.ModeIPC {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)\n\t}\n\n\tsupported := capabilities.Supported()\n\tbadAdds := supported.Difference(capabilities.New(tc.CapAdd))\n\tif !badAdds.Empty() {\n\t\treturn fmt.Errorf(\"cap_add configured with capabilities not supported by system: %s\", badAdds)\n\t}\n\n\tbadDrops := supported.Difference(capabilities.New(tc.CapDrop))\n\tif !badDrops.Empty() {\n\t\treturn fmt.Errorf(\"cap_drop configured with capabilities not supported by system: %s\", badDrops)\n\t}","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L205-L241","documentation":"TaskConfig.validate() rejects a task whose ModePID (pid_mode) is not \"\", \"private\", or \"host\". Empty is allowed to inherit the driver default; anything else cannot be mapped to an executor isolation mode, so the task is rejected at registration/validation time.","triggerScenarios":"Submitting a job whose task config sets pid_mode to a value other than \"private\", \"host\", or \"\" (e.g. Docker-style \"container:<id>\", wrong casing, typo).","commonSituations":"Porting Docker task definitions to exec driver; using \"none\" for pid_mode; typos in job HCL; copy-paste between docker and exec driver task blocks.","solutions":["Set pid_mode to \"private\" or \"host\", or omit it to inherit the driver default","Remove Docker-only values like container:<id>","Fix value casing to lowercase"],"exampleFix":"// before\ntask \"app\" {\n  driver = \"exec\"\n  config {\n    pid_mode = \"none\"\n  }\n}\n// after\ntask \"app\" {\n  driver = \"exec\"\n  config {\n    pid_mode = \"private\"\n  }","handlingStrategy":"validation","validationCode":"if !(tc.ModePID == \"\" || tc.ModePID == \"private\" || tc.ModePID == \"host\") {\n  return fmt.Errorf(\"invalid pid_mode %q\", tc.ModePID)\n}","typeGuard":"func validPidMode(v string) bool {\n  return v == \"\" || v == \"private\" || v == \"host\"\n}","tryCatchPattern":"if err := task.Validate(); err != nil {\n  if strings.Contains(err.Error(), \"pid_mode\") {\n    cfg.ModePID = \"\"\n  }\n  return err\n}","preventionTips":["Omit pid_mode unless isolation is explicitly needed","Run `nomad job validate` before submission","Don't reuse Docker task blocks verbatim for exec driver"],"tags":["nomad","exec-driver","task-config","validation"],"backgroundTag":"invalid-driver-config","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}