{"record":{"id":"4daa33614098fa71","repo":"hashicorp/nomad","slug":"failed-to-parse-security-opt-configuration-v","errorCode":null,"errorMessage":"failed to parse security_opt configuration: %v","messagePattern":"failed to parse security_opt configuration: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":1391,"sourceCode":"\thostConfig.PidMode = containerapi.PidMode(driverConfig.PidMode)\n\n\tif utsErr := d.validateNamespace(d.config.AllowedModes.UTS, \"uts_mode\", driverConfig.UTSMode); utsErr != nil {\n\t\treturn c, utsErr\n\t}\n\thostConfig.UTSMode = containerapi.UTSMode(driverConfig.UTSMode)\n\n\tif usernsErr := d.validateNamespace(d.config.AllowedModes.Userns, \"userns_mode\", driverConfig.UsernsMode); usernsErr != nil {\n\t\treturn c, usernsErr\n\t}\n\thostConfig.UsernsMode = containerapi.UsernsMode(driverConfig.UsernsMode)\n\n\thostConfig.ExtraHosts = driverConfig.ExtraHosts\n\thostConfig.SecurityOpt = driverConfig.SecurityOpt\n\thostConfig.Sysctls = driverConfig.Sysctl\n\n\thostConfig.SecurityOpt, err = parseSecurityOpts(driverConfig.SecurityOpt)\n\tif err != nil {\n\t\treturn c, fmt.Errorf(\"failed to parse security_opt configuration: %v\", err)\n\t}\n\n\tulimits, err := sliceMergeUlimit(driverConfig.Ulimit)\n\tif err != nil {\n\t\treturn c, fmt.Errorf(\"failed to parse ulimit configuration: %v\", err)\n\t}\n\thostConfig.Ulimits = ulimits\n\n\thostConfig.ReadonlyRootfs = driverConfig.ReadonlyRootfs\n\n\t// set the docker network mode\n\thostConfig.NetworkMode = containerapi.NetworkMode(driverConfig.NetworkMode)\n\n\t// if the driver config does not specify a network mode then try to use the\n\t// shared alloc network\n\tif hostConfig.NetworkMode == \"\" {\n\t\tif task.NetworkIsolation != nil && task.NetworkIsolation.Path != \"\" {\n\t\t\t// find the previously created parent container to join networks with","sourceCodeStart":1373,"sourceCodeEnd":1409,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L1373-L1409","documentation":"The docker driver's security_opt option is validated by parseSecurityOpts before being handed to the Docker daemon. Entries that are not well-formed (e.g. missing key=value separation or disallowed forms) are rejected locally with this wrapper so jobs fail at config time rather than with an opaque Docker API error.","triggerScenarios":"StartTask -> createContainerConfig calls parseSecurityOpts(driverConfig.SecurityOpt) and the security_opt list contains a malformed entry such as a flag without '=' (e.g. 'seccomp:unconfined' style instead of 'seccomp=unconfined').","commonSituations":"Users copying --security-opt CLI syntax with colons instead of equals signs; security_opt entries that docker daemon would reject (apparmor profiles that don't exist, malformed seccomp JSON paths); quoting mistakes in HCL splitting a value into separate items.","solutions":["Use key=value syntax for every security_opt entry, e.g. \"seccomp=unconfined\", \"apparmor=profile-name\",\"no-new-privileges=true\"","Remove or fix the offending entry identified by the wrapped %v error","Validate the seccomp JSON file path exists on the host if using seccomp=<path>"],"exampleFix":"// before\ndriver {\n  docker {\n    security_opt = [\"seccomp:unconfined\"]\n  }\n}\n// after\ndriver {\n  docker {\n    security_opt = [\"seccomp=unconfined\"]\n  }\n}","handlingStrategy":"validation","validationCode":"for _, opt := range cfg.SecurityOpt {\n  if !strings.Contains(opt, \"=\") {\n    return fmt.Errorf(\"security_opt must be key=value, got %q\", opt)\n  }\n}","typeGuard":null,"tryCatchPattern":"err := client.StartTask(task); if err != nil && strings.Contains(err.Error(), \"failed to parse security_opt\") { logOffendingOpts(cfg.SecurityOpt) }","preventionTips":["Always use key=value syntax for security_opt","Validate seccomp JSON paths exist on the host","Lint HCL lists for accidental value splitting"],"tags":["docker","nomad-driver","security-opt","config-validation"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}