{"record":{"id":"7f435118317deae9","repo":"hashicorp/nomad","slug":"running-as-uid-d-is-disallowed","errorCode":null,"errorMessage":"running as uid %d is disallowed","messagePattern":"running as uid (.+?) is disallowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/validators/validators.go","lineNumber":82,"sourceCode":"\treturn v, nil\n}\n\n// HasValidIDs is used when running a task to ensure the\n// given user is in the ID range defined in the task config\nfunc (v *Validator) HasValidIDs(userName string) error {\n\tuser, err := users.Lookup(userName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to identify user %q: %w\", userName, err)\n\t}\n\n\tuid, err := getUserID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator: %w\", err)\n\t}\n\n\t// check uids\n\tif v.deniedUIDs.Contains(uid) {\n\t\treturn fmt.Errorf(\"running as uid %d is disallowed\", uid)\n\t}\n\n\tgids, err := getGroupsID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator:  %w\", err)\n\t}\n\n\t// check gids\n\tfor _, gid := range gids {\n\t\tif v.deniedGIDs.Contains(gid) {\n\t\t\treturn fmt.Errorf(\"running as gid %d is disallowed\", gid)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateIDRange is used to ensure that the configuration for ID ranges is valid","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/validators/validators.go#L64-L100","documentation":"HasValidIDs checks the resolved UID against the driver's deniedUIDs set (a security policy of forbidden UID ranges configured on the client). This error means the task's user resolves to a UID that the administrator has explicitly disallowed for task execution.","triggerScenarios":"A task runs as a user whose UID falls in a denied range (typically UIDs of system/root-critical accounts, e.g. 0 or <100) when the client's validator was configured with denied_host_uids/denied GID ranges in the client config.","commonSituations":"Operator configured denied UID ranges (e.g. blocking root and service accounts) and a job tries to run as root or a service user; job migrated from a cluster without this policy to one with it; user account renumbered into a denied range.","solutions":["Change the task's user to a non-denied account (e.g. a dedicated low-privilege user outside denied ranges)","If running as this UID is legitimate, ask the cluster operator to adjust the denied_host_uids policy in the client config","Verify the user's actual UID (id -u <user>) against the denied ranges documented in the client config","Do not run tasks as root — create a dedicated task user"],"exampleFix":"// before (job HCL) — root is denied\nuser = \"root\"\n// after\nuser = \"nomad-task\"","handlingStrategy":"validation","validationCode":"u, err := user.Lookup(userName)\nif err != nil { return err }\nuid, _ := strconv.Atoi(u.Uid)\nif deniedUIDs.Contains(uid) {\n    return fmt.Errorf(\"user %q (uid %d) is in a denied range; pick another user\", userName, uid)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document the client's denied_host_uids policy for job authors","Run tasks as dedicated low-privilege users, never root or service accounts","Check id -u <user> against policy ranges in CI job linting"],"tags":["security","uid","policy","validation"],"backgroundTag":"uid-denied-by-policy","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}