{"record":{"id":"4ed6bf4af46fc7a7","repo":"hashicorp/nomad","slug":"dynamic-workload-users-disabled","errorCode":null,"errorMessage":"dynamic workload users disabled","messagePattern":"dynamic workload users disabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/users/dynamic/pool.go","lineNumber":102,"sourceCode":"\tif opts.MaxUGID < opts.MinUGID {\n\t\tpanic(\"bug: users pool max must be >= min\")\n\t}\n\t// a small but reasonable number of tasks to expect\n\tconst defaultPoolCapacity = 32\n\treturn &pool{\n\t\tmin:  UGID(opts.MinUGID),\n\t\tmax:  UGID(opts.MaxUGID),\n\t\tlock: new(sync.Mutex),\n\t\tused: set.New[UGID](defaultPoolCapacity),\n\t}\n}\n\n// noopPool is an implementation of Pool that does not allow acquiring ugids\ntype noopPool struct{}\n\nfunc (*noopPool) Restore(UGID) {}\nfunc (*noopPool) Acquire() (UGID, error) {\n\treturn 0, errors.New(\"dynamic workload users disabled\")\n}\nfunc (*noopPool) Release(UGID) error {\n\t// avoid giving an error if a client is restarted with a new config\n\t// that disables dynamic workload users but still has a task running\n\t// making use of one\n\treturn nil\n}\n\ntype pool struct {\n\tmin UGID\n\tmax UGID\n\n\tlock *sync.Mutex\n\tused *set.Set[UGID]\n}\n\nfunc (p *pool) Restore(id UGID) {\n\thelper.WithLock(p.lock, func() {","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/users/dynamic/pool.go#L84-L120","documentation":"The noopPool's Acquire always returns this error because dynamic workload users are disabled in the configuration. The pool exists only so callers have a working Pool implementation; acquiring a dynamic user is intentionally unsupported.","triggerScenarios":"Calling Acquire() on the pool obtained when dynamic workload users are disabled in the Nomad client configuration; any code path that assumes a functional pool while the feature flag is off.","commonSituations":"Operator disabled dynamic workload users in client config while workloads still request dynamic users; driver/task code unconditionally calling Acquire without checking whether the feature is enabled.","solutions":["Enable dynamic workload users in the Nomad client configuration if tasks require them","Check whether the feature is enabled before calling Acquire and use a static user instead","Note that Release on noopPool returns nil by design, so only Acquire needs guarding","Upgrade/downgrade or align agent config across the cluster so client and workload expectations match"],"exampleFix":"// before\nugid, err := pool.Acquire()\nif err != nil { return err }\n// after: check feature enabled first\nif !dynamicUsersEnabled {\n  return useStaticUser()\n}\nugid, err := pool.Acquire()","handlingStrategy":"try-catch","validationCode":"if !dynamicUsersEnabled {\n  return useStaticOrFallbackUser()\n}","typeGuard":null,"tryCatchPattern":"ugid, err := pool.Acquire()\nif err != nil && strings.Contains(err.Error(), \"dynamic workload users disabled\") {\n  // feature off; fall back to default/static user\n  return fallback()\n}","preventionTips":["Confirm the client config enables dynamic workload users before scheduling tasks needing them","Keep client configs consistent across the cluster","Check the feature flag before calling any Pool method other than Release (Release is a safe no-op)","Document that disabling the feature invalidates in-flight dynamic users"],"tags":["go","nomad","configuration","feature-disabled"],"backgroundTag":"feature-disabled-by-config","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}