{"record":{"id":"7fbf18304c388220","repo":"hashicorp/nomad","slug":"used-task-driver-q-is-not-allowed-in-namespace-q","errorCode":null,"errorMessage":"used task driver %q is not allowed in namespace %q","messagePattern":"used task driver %q is not allowed in namespace %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_validators.go","lineNumber":41,"sourceCode":"\tns, err := c.srv.State().NamespaceByName(nil, job.Namespace)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif ns == nil {\n\t\treturn nil, fmt.Errorf(\"job %q is in nonexistent namespace %q\", job.ID, job.Namespace)\n\t}\n\n\tvar disallowedDrivers []string\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, t := range tg.Tasks {\n\t\t\tif !taskValidateDriver(t, ns) {\n\t\t\t\tdisallowedDrivers = append(disallowedDrivers, t.Driver)\n\t\t\t}\n\t\t}\n\t}\n\tif len(disallowedDrivers) > 0 {\n\t\tif len(disallowedDrivers) == 1 {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used task driver %q is not allowed in namespace %q\", disallowedDrivers[0], ns.Name,\n\t\t\t)\n\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used task drivers %q are not allowed in namespace %q\", disallowedDrivers, ns.Name,\n\t\t\t)\n\t\t}\n\t}\n\n\tvar disallowedNetworkModes []string\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, network := range tg.Networks {\n\t\t\tif allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {\n\t\t\t\tdisallowedNetworkModes = append(disallowedNetworkModes, network_mode)\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_validators.go#L23-L59","documentation":"Namespaces can constrain which task drivers are allowed (namespace driver allow/deny lists). After looking up the namespace, this validator collects any task whose driver is disallowed; if exactly one disallowed driver was found, registration fails with this singular-form error naming the driver and namespace.","triggerScenarios":"Registering a job where exactly one task in the entire job uses a driver not in the namespace's allowed driver list. Raised in Validate when len(disallowedDrivers) == 1.","commonSituations":"Team-scoped namespaces restrict drivers (e.g. only docker allowed) but a job uses exec or raw_exec; namespace driver policy updated after jobs already rely on other drivers; multi-cluster job ported to a namespace with stricter driver policy.","solutions":["Change the task's driver to one allowed in the namespace","Update the namespace driver policy (nomad namespace apply -allow-drivers/-deny-drivers) to permit the driver","Move the job to a namespace whose driver policy matches its needs"],"exampleFix":"// before\nnamespace \"team\" { driver_policy { deny = [\"raw_exec\"] } } // job uses raw_exec\n// after\nnomad namespace apply -allow-drivers=raw_exec team\n// or switch the task driver to docker","handlingStrategy":"validation","validationCode":"// before submit\nns, _ := client.Namespaces().Info(job.Namespace, nil)\nallowed := ns.DriverConfig != nil && len(ns.DriverConfig.DeniedDrivers) == 0\nfor _, t := range allTasks(job) {\n  if !driverAllowedInNamespace(ns, t.Driver) {\n    return fmt.Errorf(\"driver %s not allowed in %s\", t.Driver, ns.Name)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mirror namespace driver policies in CI job linting","When tightening namespace policies, audit existing jobs first","Document per-namespace allowed drivers for job authors"],"tags":["nomad","namespace","driver-policy","job-validation"],"backgroundTag":"driver-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}