{"record":{"id":"723894591526dcdd","repo":"hashicorp/nomad","slug":"cannot-apply-allowed-modes-configuration-q-is-no","errorCode":null,"errorMessage":"cannot apply allowed_modes configuration, %q is not a valid pid_mode","messagePattern":"cannot apply allowed_modes configuration, %q is not a valid pid_mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/config.go","lineNumber":883,"sourceCode":"func (d *Driver) TaskConfigSchema() (*hclspec.Spec, error) {\n\treturn taskConfigSpec, nil\n}\n\n// Capabilities is returned by the Capabilities RPC and indicates what optional\n// features this driver supports.\nfunc (d *Driver) Capabilities() (*drivers.Capabilities, error) {\n\tdriverCapabilities.DisableLogCollection = d.config != nil && d.config.DisableLogCollection\n\treturn driverCapabilities, nil\n}\n\nfunc validateAllowedNamespace(allowedNS AllowedModesConfig) error {\n\t// check user supplied allowlist values against containerapi type validator\n\t// https://github.com/moby/moby/blob/master/api/types/container/hostconfig.go\n\n\tif len(allowedNS.PID) > 0 {\n\t\tfor _, v := range allowedNS.PID {\n\t\t\tif !containerapi.PidMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid pid_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\tif len(allowedNS.IPC) > 0 {\n\t\tfor _, v := range allowedNS.IPC {\n\t\t\tif !containerapi.IpcMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid ipc_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(allowedNS.Userns) > 0 {\n\t\tfor _, v := range allowedNS.Userns {\n\t\t\tif !containerapi.UsernsMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid userns_mode\", v)\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":865,"sourceCodeEnd":901,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/config.go#L865-L901","documentation":"When validating the docker driver's allowed_modes allowlist, each configured pid_mode value is checked with containerapi.PidMode(v).Valid(). An invalid entry rejects the whole allowlist at plugin setup, because applying it would let jobs request a pid_mode the Docker API would reject or that is semantically wrong.","triggerScenarios":"Setting allowlist entry pid_modes = [\"host\", \"bogus\"] (or any value not in \"\", \"host\", \"container:<name>\") in the docker plugin config; validation runs during driver SetupClient.","commonSituations":"Operators typo 'host' as 'Host' or 'hostr', or attempt container-scoped pid modes like 'container:foo' with wrong syntax, or copy values from older Docker docs that no longer validate.","solutions":["Correct the allowlist entry to a valid pid_mode value: \"\", \"host\", or \"container:<name|id>\".","Check case-sensitivity — values are matched exactly by Docker's PidMode.Valid(), so use lowercase 'host'.","Remove the offending entry from pid_modes if it was experimental/removed in your Docker version.","Test validity locally with 'docker run --pid <value> ...' against the same daemon version."],"exampleFix":"// before\nplugin \"docker\" {\n  config {\n    allowlist {\n      pid_modes = [\"Host\", \"container:sidecar\"]\n    }\n  }\n}\n// after\nplugin \"docker\" {\n  config {\n    allowlist {\n      pid_modes = [\"host\", \"container:sidecar\"]\n    }\n  }\n}","handlingStrategy":"validation","validationCode":"// Pre-validate allowlist entries before writing config\nvar validPidModes = map[string]bool{\"\": true, \"host\": true}\nvalidPid := func(v string) bool {\n    return validPidModes[v] || strings.HasPrefix(v, \"container:\")\n}\nfor _, m := range cfg.AllowedModes.PID {\n    if !validPid(m) { return fmt.Errorf(\"invalid pid_mode %q\", m) }\n}","typeGuard":null,"tryCatchPattern":"Treat driver setup error as fatal config error: catch, surface the offending allowlist entry, and stop the deploy.","preventionTips":["Only use documented values: \"\", \"host\", \"container:<name|id>\".","Match against your exact Docker daemon version's moby hostconfig validators.","Add a config lint step that checks allowlist entries before rollout."],"tags":["config","docker","validation","pid-mode"],"backgroundTag":"invalid-config-allowlist-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}