{"record":{"id":"5651f5afffb51d42","repo":"hashicorp/nomad","slug":"docker-privileged-mode-is-disabled-on-this-nomad-a","errorCode":null,"errorMessage":"Docker privileged mode is disabled on this Nomad agent","messagePattern":"Docker privileged mode is disabled on this Nomad agent","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":1212,"sourceCode":"\t\tConfig: driverConfig.Logging.Config,\n\t}\n\n\tif hostConfig.LogConfig.Type == \"\" && hostConfig.LogConfig.Config == nil {\n\t\tlogger.Trace(\"no docker log driver provided, defaulting to plugin config\")\n\t\thostConfig.LogConfig.Type = d.config.Logging.Type\n\t\thostConfig.LogConfig.Config = d.config.Logging.Config\n\t}\n\n\tlogger.Debug(\"configured resources\",\n\t\t\"memory\", hostConfig.Memory, \"memory_reservation\", hostConfig.MemoryReservation,\n\t\t\"cpu_shares\", hostConfig.CPUShares, \"cpu_quota\", hostConfig.CPUQuota,\n\t\t\"cpu_period\", hostConfig.CPUPeriod)\n\n\tlogger.Debug(\"binding directories\", \"binds\", hclog.Fmt(\"%#v\", hostConfig.Binds))\n\n\t//  set privileged mode\n\tif driverConfig.Privileged && !d.config.AllowPrivileged {\n\t\treturn c, fmt.Errorf(`Docker privileged mode is disabled on this Nomad agent`)\n\t}\n\thostConfig.Privileged = driverConfig.Privileged\n\n\t// get docker client info (we need to know the runtime to adjust\n\t// OS-specific capabilities)\n\tclient, err := d.getDockerClient()\n\tif err != nil {\n\t\treturn c, err\n\t}\n\tver, err := client.ServerVersion(d.ctx, mclient.ServerVersionOptions{})\n\tif err != nil {\n\t\treturn c, err\n\t}\n\n\t// set add/drop capabilities\n\tif hostConfig.CapAdd, hostConfig.CapDrop, err = capabilities.Delta(\n\t\tcapabilities.DockerDefaults(system.VersionResponse{\n\t\t\tPlatform: system.PlatformInfo{","sourceCodeStart":1194,"sourceCodeEnd":1230,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L1194-L1230","documentation":"The Docker driver only applies the privileged flag when the Nomad agent's client-level allow_privileged option is enabled. If a task's driver config sets privileged = true but the agent has not opted in, createContainerConfig fails fast. This is an intentional operator-controlled safety gate.","triggerScenarios":"StartTask -> createContainerConfig sees driverConfig.Privileged == true while d.config.AllowPrivileged is false (agent client config lacks allow_privileged = true).","commonSituations":"Jobs needing Docker-in-Docker, fuse, or kernel access are submitted to agents that never enabled allow_privileged; a job template was copied from a cluster where the flag was enabled to one where it is not.","solutions":["In the agent's client config set allow_privileged = true under the plugin docker configuration and restart the agent","If privilege is not truly required, remove privileged = true from the task's docker driver config and use capabilities instead","Run the workload on a client pool whose agents allow privileged containers"],"exampleFix":"// before (agent config)\nplugin \"docker\" {\n  config { }\n}\n// after\nplugin \"docker\" {\n  config {\n    allow_privileged = true\n  }\n}","handlingStrategy":"validation","validationCode":"if jobUsesPrivileged && !agentAllowsPrivileged {\n  return errors.New(\"job requires privileged; agent must set allow_privileged = true\")\n}","typeGuard":"func privilegedAllowed(cfg ClientConfig) bool { return cfg.PluginDocker.AllowPrivileged }","tryCatchPattern":"err := client.StartTask(task); if err != nil && strings.Contains(err.Error(), \"privileged mode is disabled\") { alertOperator(\"enable allow_privileged\") }","preventionTips":["Set allow_privileged = true on every client pool that runs privileged jobs","Prefer capabilities over privileged where possible","Document agent capability requirements per client pool"],"tags":["docker","nomad-driver","privileged","security"],"backgroundTag":"privileged-mode-disabled","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}