{"record":{"id":"71232badde474221","repo":"hashicorp/nomad","slug":"filesystem-isolation-extra-paths-contains-invalid","errorCode":null,"errorMessage":"filesystem_isolation_extra_paths contains invalid lockdown path %q","messagePattern":"filesystem_isolation_extra_paths contains invalid lockdown path %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/config/artifact.go","lineNumber":246,"sourceCode":"\t\treturn fmt.Errorf(\"decompression_size_limit must not be nil\")\n\t}\n\tif v, err := humanize.ParseBytes(*a.DecompressionSizeLimit); err != nil {\n\t\treturn fmt.Errorf(\"decompression_size_limit is not a valid size: %w\", err)\n\t} else if v > math.MaxInt64 {\n\t\treturn fmt.Errorf(\"decompression_size_limit must be < %d but found %d\", int64(math.MaxInt64), v)\n\t}\n\n\tif a.DisableArtifactInspection == nil {\n\t\treturn fmt.Errorf(\"disable_artifact_inspection must be set\")\n\t}\n\n\tif a.DisableFilesystemIsolation == nil {\n\t\treturn fmt.Errorf(\"disable_filesystem_isolation must be set\")\n\t}\n\n\tfor _, p := range a.FilesystemIsolationExtraPaths {\n\t\tif _, err := landlock.ParsePath(p); err != nil {\n\t\t\treturn fmt.Errorf(\"filesystem_isolation_extra_paths contains invalid lockdown path %q\", p)\n\t\t}\n\t}\n\n\tif a.SetEnvironmentVariables == nil {\n\t\treturn fmt.Errorf(\"set_environment_variables must be set\")\n\t}\n\n\treturn nil\n}\n\nfunc DefaultArtifactConfig() *ArtifactConfig {\n\treturn &ArtifactConfig{\n\t\t// Read timeout for HTTP operations. Must be long enough to\n\t\t// accommodate large/slow downloads.\n\t\tHTTPReadTimeout: new(\"30m\"),\n\n\t\t// Maximum download size. Must be large enough to accommodate\n\t\t// large downloads.","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/config/artifact.go#L228-L264","documentation":"ArtifactConfig.Validate parses each entry of FilesystemIsolationExtraPaths with landlock.ParsePath; any entry that is not a valid absolute landlock-able path produces this error. It ensures extra isolation paths can actually be enforced by the kernel's landlock facility.","triggerScenarios":"A filesystem_isolation_extra_paths entry is not an existing/absolute path or otherwise rejected by landlock.ParsePath while Validate() runs on the artifact config.","commonSituations":"Typos or relative paths in the config (e.g. \"data/secrets\" instead of \"/etc/secrets\"); referencing non-existent directories; copying paths from another host with a different filesystem layout.","solutions":["Change the listed path to an absolute, existing path landlock can parse","Remove entries that are not valid landlock paths","Verify each path exists on the agent host: ls <path>"],"exampleFix":"// before\nfilesystem_isolation_extra_paths = [\"secrets\"]\n// after\nfilesystem_isolation_extra_paths = [\"/etc/secrets\"]","handlingStrategy":"validation","validationCode":"for _, p := range cfg.Artifact.FilesystemIsolationExtraPaths {\n    if !filepath.IsAbs(p) {\n        return fmt.Errorf(\"isolation path %q must be absolute\", p)\n    }\n    if _, err := os.Stat(p); err != nil {\n        return fmt.Errorf(\"isolation path %q not accessible: %w\", p, err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use absolute, existing paths in filesystem_isolation_extra_paths","Validate paths on the actual agent host, not a build machine","Run `nomad agent validate <config>` before deploying config changes"],"tags":["config","validation","landlock","paths"],"backgroundTag":"invalid-path-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}