{"record":{"id":"628cb0b755cdcf54","repo":"hashicorp/nomad","slug":"dev-connect-uses-network-namespaces-and-is-only-s","errorCode":null,"errorMessage":"-dev-connect uses network namespaces and is only supported for root: %v","messagePattern":"-dev-connect uses network namespaces and is only supported for root: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/agent/config.go","lineNumber":1722,"sourceCode":"\nfunc (mode *devModeConfig) enabled() bool {\n\treturn mode.defaultMode || mode.connectMode ||\n\t\tmode.consulMode || mode.vaultMode\n}\n\nfunc (mode *devModeConfig) validate() error {\n\tif mode.connectMode {\n\t\tif runtime.GOOS != \"linux\" {\n\t\t\t// strictly speaking -dev-connect only binds to the\n\t\t\t// non-localhost interface, but given its purpose\n\t\t\t// is to support a feature with network namespaces\n\t\t\t// we'll return an error here rather than let the agent\n\t\t\t// come up and fail unexpectedly to run jobs\n\t\t\treturn fmt.Errorf(\"-dev-connect is only supported on linux.\")\n\t\t}\n\t\tu, err := users.Current()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"-dev-connect uses network namespaces and is only supported for root: %v\", err)\n\t\t}\n\t\tif u.Uid != \"0\" {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"-dev-connect uses network namespaces and is only supported for root.\")\n\t\t}\n\t\t// Ensure Consul is on PATH\n\t\tif _, err := exec.LookPath(\"consul\"); err != nil {\n\t\t\treturn fmt.Errorf(\"-dev-connect requires a 'consul' binary in Nomad's $PATH\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (mode *devModeConfig) networkConfig() error {\n\tif runtime.GOOS == \"windows\" {\n\t\tmode.bindAddr = \"127.0.0.1\"\n\t\tmode.iface = \"Loopback Pseudo-Interface 1\"","sourceCodeStart":1704,"sourceCodeEnd":1740,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/agent/config.go#L1704-L1740","documentation":"After confirming the OS is Linux, -dev-connect checks the current user. If the OS call to get the current user fails, the agent cannot verify privileges needed for network namespaces and returns this error including the underlying reason.","triggerScenarios":"users.Current() returns an error during -dev-connect config validation — e.g. running in environments without a resolvable uid (stripped containers, unusual NSS setups).","commonSituations":"Running the agent in minimal Docker images lacking /etc/passwd entries; sandboxed environments where user lookup fails.","solutions":["Run the agent as root in a proper Linux environment.","Fix the container image so user lookup works (ensure /etc/passwd exists and the current uid is defined).","Inspect the wrapped error (%v) to identify the lookup failure."],"exampleFix":"# before (fails: no user entry)\ndocker run --user 12345 nomad-dev nomad agent -dev-connect\n# after\ndocker run --user root nomad-dev nomad agent -dev-connect","handlingStrategy":"validation","validationCode":"u, err := user.Current()\nif err != nil || u.Uid != \"0\" {\n  return errors.New(\"-dev-connect must run as root on Linux\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run dev agents as root when using -dev-connect","Verify user lookup works in your container image","Read the wrapped %v detail to diagnose user-resolution issues"],"tags":["linux","permissions","dev-connect","containers"],"backgroundTag":"insufficient-privileges","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}