{"record":{"id":"5f28120c3a629769","repo":"hashicorp/nomad","slug":"requested-runtime-q-is-not-allowed","errorCode":null,"errorMessage":"requested runtime %q is not allowed","messagePattern":"requested runtime %q is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":1075,"sourceCode":"\t\tOpenStdin:  driverConfig.Interactive,\n\t}\n\n\tif driverConfig.WorkDir != \"\" {\n\t\tconfig.WorkingDir = driverConfig.WorkDir\n\t}\n\n\tcontainerRuntime := driverConfig.Runtime\n\tif _, ok := task.DeviceEnv[nvidiaVisibleDevices]; ok {\n\t\tif !d.gpuRuntime {\n\t\t\treturn c, fmt.Errorf(\"requested docker runtime %q was not found\", d.config.GPURuntimeName)\n\t\t}\n\t\tif containerRuntime != \"\" && containerRuntime != d.config.GPURuntimeName {\n\t\t\treturn c, fmt.Errorf(\"conflicting runtime requests: gpu runtime %q conflicts with task runtime %q\", d.config.GPURuntimeName, containerRuntime)\n\t\t}\n\t\tcontainerRuntime = d.config.GPURuntimeName\n\t}\n\tif _, ok := d.config.allowRuntimes[containerRuntime]; !ok && containerRuntime != \"\" {\n\t\treturn c, fmt.Errorf(\"requested runtime %q is not allowed\", containerRuntime)\n\t}\n\n\t// Validate isolation modes on windows\n\tif runtime.GOOS != \"windows\" {\n\t\tif driverConfig.Isolation != \"\" {\n\t\t\treturn c, fmt.Errorf(\"Failed to create container configuration, cannot use isolation mode \\\"%s\\\" on %s\", driverConfig.Isolation, runtime.GOOS)\n\t\t}\n\t} else {\n\t\tif driverConfig.Isolation == \"\" {\n\t\t\tdriverConfig.Isolation = windowsIsolationModeHyperV\n\t\t}\n\t\tif !slices.Contains(windowsIsolationModes, driverConfig.Isolation) {\n\t\t\treturn c, fmt.Errorf(\"Unsupported isolation mode \\\"%s\\\"\", driverConfig.Isolation)\n\t\t}\n\t}\n\n\tvar pidsLimit int64 = -1 // default unlimited\n","sourceCodeStart":1057,"sourceCodeEnd":1093,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L1057-L1093","documentation":"The docker plugin maintains an allowlist of runtimes (allow_runtimes plugin config; historically allow_caps-style safety). If the resolved containerRuntime (task-specified, or GPU-derived) is not empty and not in d.config.allowRuntimes, container creation is rejected. This is a deliberate operator security control on which runtimes tasks may use.","triggerScenarios":"Job sets runtime = \"sysbox-runc\" (or any custom runtime) while the client plugin config does not include it in allow_runtimes; GPU runtime name itself not present in the allowlist after a config change.","commonSituations":"Operator configured allow_runtimes = [\"runc\"] but jobs use a kata/sysbox/gVisor runtime; plugin config rolled out without the new runtime name; renamed runtime after a Docker upgrade.","solutions":["Add the desired runtime to the plugin's allow_runtimes in the Nomad client config and reload Nomad: allow_runtimes = [\"runc\", \"sysbox-runc\"].","Change the job's runtime option to one that is allowlisted (usually omit it and use the default runc).","Verify with `docker info` the runtime name spelled in the job exactly matches a registered runtime."],"exampleFix":"// client plugin config\n// before\nplugin \"docker\" { config { allow_runtimes = [\"runc\"] } }\n// after\nplugin \"docker\" { config { allow_runtimes = [\"runc\", \"nvidia\"] } }","handlingStrategy":"validation","validationCode":"function validateRuntimeAllowed(runtime, allowedRuntimes) {\n  if (runtime && !allowedRuntimes.includes(runtime)) {\n    throw new Error(`runtime \"${runtime}\" is not in allow_runtimes: ${allowedRuntimes.join(', ')}`);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await client.jobs.submit(job);\n} catch (err) {\n  if (/is not allowed/.test(err.message)) {\n    console.error('Add runtime to plugin allow_runtimes or change the job');\n  }\n  throw err;\n}","preventionTips":["Mirror plugin allow_runtimes into job linting rules.","Update allow_runtimes before rolling out jobs using new runtimes.","Reload Nomad clients after editing plugin config so the allowlist takes effect."],"tags":["docker","runtime","security","allowlist"],"backgroundTag":"runtime-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}