{"record":{"id":"8a34f6f390134e26","repo":"hashicorp/nomad","slug":"cannot-apply-allowed-modes-configuration-q-is-no-8a34f6","errorCode":null,"errorMessage":"cannot apply allowed_modes configuration, %q is not a valid ipc_mode","messagePattern":"cannot apply allowed_modes configuration, %q is not a valid ipc_mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/config.go","lineNumber":890,"sourceCode":"\tdriverCapabilities.DisableLogCollection = d.config != nil && d.config.DisableLogCollection\n\treturn driverCapabilities, nil\n}\n\nfunc validateAllowedNamespace(allowedNS AllowedModesConfig) error {\n\t// check user supplied allowlist values against containerapi type validator\n\t// https://github.com/moby/moby/blob/master/api/types/container/hostconfig.go\n\n\tif len(allowedNS.PID) > 0 {\n\t\tfor _, v := range allowedNS.PID {\n\t\t\tif !containerapi.PidMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid pid_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\tif len(allowedNS.IPC) > 0 {\n\t\tfor _, v := range allowedNS.IPC {\n\t\t\tif !containerapi.IpcMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid ipc_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(allowedNS.Userns) > 0 {\n\t\tfor _, v := range allowedNS.Userns {\n\t\t\tif !containerapi.UsernsMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid userns_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(allowedNS.UTS) > 0 {\n\t\tfor _, v := range allowedNS.UTS {\n\t\t\tif !containerapi.UTSMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid utc_mode\", v)\n\t\t\t}\n\t\t}","sourceCodeStart":872,"sourceCodeEnd":908,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/config.go#L872-L908","documentation":"Same allowlist validation path as pid_mode, but for ipc_mode: each entry in the ipc_modes allowlist is checked with containerapi.IpcMode(v).Valid(). An unrecognized value fails plugin setup with this error.","triggerScenarios":"Configuring ipc_modes allowlist with values outside \"\", \"host\", \"private\", \"shareable\", \"container:<name|id>\" (and daemon-supported variants).","commonSituations":"Operators write 'shared' instead of 'shareable', or 'none', or misspell 'container:' prefixed modes; also happens when copying Docker CLI examples from a different Docker release.","solutions":["Use only valid ipc_mode values: \"\", \"private\", \"host\", \"shareable\", or \"container:<name|id>\".","Replace 'shared'/'share' with the correct 'shareable'.","Verify against your Docker daemon version's container.HostConfig.IpcMode.Valid() semantics.","Remove invalid entries until the allowlist validates, then re-test jobs."],"exampleFix":"// before\nipc_modes = [\"shared\"]\n// after\nipc_modes = [\"shareable\", \"host\"]","handlingStrategy":"validation","validationCode":"var validIpcModes = map[string]bool{\"\": true, \"host\": true, \"private\": true, \"shareable\": true}\nvalidIpc := func(v string) bool {\n    return validIpcModes[v] || strings.HasPrefix(v, \"container:\")\n}","typeGuard":null,"tryCatchPattern":"Catch the setup error and fail config validation early, naming the invalid ipc_modes entry.","preventionTips":["Remember the exact set: private, host, shareable, container:<name|id>, empty.","Don't confuse with podman's 'shareable' vs 'shared' variants.","Lint allowlists in CI before applying agent configs."],"tags":["config","docker","validation","ipc-mode"],"backgroundTag":"invalid-config-allowlist-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}