{"record":{"id":"8a583f2082206bd2","repo":"hashicorp/nomad","slug":"used-task-drivers-q-are-not-allowed-in-namespace","errorCode":null,"errorMessage":"used task drivers %q are not allowed in namespace %q","messagePattern":"used task drivers %q are not allowed in namespace %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_validators.go","lineNumber":46,"sourceCode":"\t\treturn nil, fmt.Errorf(\"job %q is in nonexistent namespace %q\", job.ID, job.Namespace)\n\t}\n\n\tvar disallowedDrivers []string\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, t := range tg.Tasks {\n\t\t\tif !taskValidateDriver(t, ns) {\n\t\t\t\tdisallowedDrivers = append(disallowedDrivers, t.Driver)\n\t\t\t}\n\t\t}\n\t}\n\tif len(disallowedDrivers) > 0 {\n\t\tif len(disallowedDrivers) == 1 {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used task driver %q is not allowed in namespace %q\", disallowedDrivers[0], ns.Name,\n\t\t\t)\n\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used task drivers %q are not allowed in namespace %q\", disallowedDrivers, ns.Name,\n\t\t\t)\n\t\t}\n\t}\n\n\tvar disallowedNetworkModes []string\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, network := range tg.Networks {\n\t\t\tif allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {\n\t\t\t\tdisallowedNetworkModes = append(disallowedNetworkModes, network_mode)\n\t\t\t}\n\t\t}\n\t}\n\tif len(disallowedNetworkModes) > 0 {\n\t\tif len(disallowedNetworkModes) == 1 {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used group network mode %q is not allowed in namespace %q\", disallowedNetworkModes[0], ns.Name,\n\t\t\t)","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_validators.go#L28-L64","documentation":"Same validation as the singular case, but triggered when two or more tasks use disallowed drivers. The plural-form message includes the full list of disallowed drivers (Go %q of a []string) and the namespace name, so the operator can fix all offending tasks at once.","triggerScenarios":"Registering a job where 2+ tasks use drivers not allowed by the namespace driver policy. Raised in Validate when len(disallowedDrivers) > 1.","commonSituations":"Multi-task-group jobs (e.g. docker + qemu + exec) deployed into a namespace allowing only a subset; namespace policy tightened retroactively; batch-converted job files using several restricted drivers.","solutions":["Change every listed task's driver to an allowed driver","Update the namespace driver policy to allow the listed drivers","Split the job across namespaces whose policies match each driver"],"exampleFix":"// before\n// namespace allows [docker]; tasks use exec and qemu\n// after\nnomad namespace apply -allow-drivers=docker,exec,qemu team\n// or rewrite tasks to use docker only","handlingStrategy":"validation","validationCode":"// before submit\nns, _ := client.Namespaces().Info(job.Namespace, nil)\nvar bad []string\nfor _, t := range allTasks(job) {\n  if !driverAllowedInNamespace(ns, t.Driver) { bad = append(bad, t.Driver) }\n}\nif len(bad) > 0 { return fmt.Errorf(\"disallowed drivers: %v\", bad) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Collect ALL offending drivers before fixing, not one at a time","Test multi-task-group jobs against namespace policy in staging","Keep driver usage homogeneous per namespace where possible"],"tags":["nomad","namespace","driver-policy","job-validation"],"backgroundTag":"driver-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}