{"record":{"id":"8f2d7c9f3fd8b606","repo":"hashicorp/nomad","slug":"cap-drop-configured-with-capabilities-not-supporte-8f2d7c","errorCode":null,"errorMessage":"cap_drop configured with capabilities not supported by system: %s","messagePattern":"cap_drop configured with capabilities not supported by system: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/java/driver.go","lineNumber":219,"sourceCode":"\tdefault:\n\t\treturn fmt.Errorf(\"pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)\n\n\t}\n\n\tswitch tc.ModeIPC {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)\n\t}\n\n\tsupported := capabilities.Supported()\n\tbadAdds := supported.Difference(capabilities.New(tc.CapAdd))\n\tif !badAdds.Empty() {\n\t\treturn fmt.Errorf(\"cap_add configured with capabilities not supported by system: %s\", badAdds)\n\t}\n\tbadDrops := supported.Difference(capabilities.New(tc.CapDrop))\n\tif !badDrops.Empty() {\n\t\treturn fmt.Errorf(\"cap_drop configured with capabilities not supported by system: %s\", badDrops)\n\t}\n\n\tif tc.WorkDir != \"\" && !filepath.IsAbs(tc.WorkDir) {\n\t\treturn fmt.Errorf(\"work_dir must be an absolute path: %s\", tc.WorkDir)\n\t}\n\treturn nil\n}\n\n// TaskState is the state which is encoded in the handle returned in\n// StartTask. This information is needed to rebuild the taskConfig state and handler\n// during recovery.\ntype TaskState struct {\n\tReattachConfig *pstructs.ReattachConfig\n\tTaskConfig     *drivers.TaskConfig\n\tPid            int\n\tStartedAt      time.Time\n}\n","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/java/driver.go#L201-L237","documentation":"This error is thrown by the Nomad Java driver during validation when the cap_drop field lists capabilities not supported by the host system. Even though dropping unsupported capabilities would be harmless at runtime, the driver strictly validates the list against capabilities.Supported() and rejects any unknown names. It enforces correct capability spelling and keeps task configs portable.","triggerScenarios":"A task's Java driver config sets CapDrop with names outside the system's supported capability set; validate() computes supported.Difference(capabilities.New(tc.CapDrop)) and finds a non-empty remainder.","commonSituations":"Misspelled capability names in cap_drop; copy-pasted configs referencing capabilities from other kernels or runtimes (e.g. Docker-only names); configs written on newer hosts then scheduled on older kernels.","solutions":["Remove or correct the unsupported capability names in cap_drop","List only capabilities present in the host's supported set","Verify spelling and CAP_ prefix conventions for each entry","Schedule the task on hosts that support the listed capabilities"],"exampleFix":"// before\n-cap_drop = [\"CAP_SYS_ADMIN\", \"CAP_MKNOD\", \"CAP_SYS_TIMEE\"]\n// after\n-cap_drop = [\"CAP_SYS_ADMIN\", \"CAP_MKNOD\"]","handlingStrategy":"validation","validationCode":"import \"github.com/hashicorp/nomad/client/lib/capabilities\"\n\nfunc checkCapDrop(drops []string) error {\n    bad := capabilities.Supported().Difference(capabilities.New(drops))\n    if !bad.Empty() {\n        return fmt.Errorf(\"unsupported cap_drop: %s\", bad)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only drop capabilities that appear in the host's supported set","Lint job specs for capability names with a shared constant list","Validate jobs in CI with nomad job validate on an equivalent host","Avoid copying capability lists between heterogeneous hosts"],"tags":["nomad","java-driver","linux-capabilities","validation"],"backgroundTag":"unsupported-capability","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}