{"record":{"id":"96467c10d2cf2b8c","repo":"hashicorp/nomad","slug":"dev-connect-uses-network-namespaces-and-is-only-s-96467c","errorCode":null,"errorMessage":"-dev-connect uses network namespaces and is only supported for root.","messagePattern":"-dev-connect uses network namespaces and is only supported for root\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/agent/config.go","lineNumber":1726,"sourceCode":"}\n\nfunc (mode *devModeConfig) validate() error {\n\tif mode.connectMode {\n\t\tif runtime.GOOS != \"linux\" {\n\t\t\t// strictly speaking -dev-connect only binds to the\n\t\t\t// non-localhost interface, but given its purpose\n\t\t\t// is to support a feature with network namespaces\n\t\t\t// we'll return an error here rather than let the agent\n\t\t\t// come up and fail unexpectedly to run jobs\n\t\t\treturn fmt.Errorf(\"-dev-connect is only supported on linux.\")\n\t\t}\n\t\tu, err := users.Current()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"-dev-connect uses network namespaces and is only supported for root: %v\", err)\n\t\t}\n\t\tif u.Uid != \"0\" {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"-dev-connect uses network namespaces and is only supported for root.\")\n\t\t}\n\t\t// Ensure Consul is on PATH\n\t\tif _, err := exec.LookPath(\"consul\"); err != nil {\n\t\t\treturn fmt.Errorf(\"-dev-connect requires a 'consul' binary in Nomad's $PATH\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (mode *devModeConfig) networkConfig() error {\n\tif runtime.GOOS == \"windows\" {\n\t\tmode.bindAddr = \"127.0.0.1\"\n\t\tmode.iface = \"Loopback Pseudo-Interface 1\"\n\t\treturn nil\n\t}\n\tif runtime.GOOS == \"darwin\" {\n\t\tmode.bindAddr = \"127.0.0.1\"","sourceCodeStart":1708,"sourceCodeEnd":1744,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/agent/config.go#L1708-L1744","documentation":"devModeConfig.validate rejects -dev-connect when the current user could not be identified or is not root: Consul Connect with -dev requires Linux network namespaces, which only root can create, so the dev agent refuses to start rather than failing later.","triggerScenarios":"Running `nomad agent -dev-connect` as a non-root Linux user (uid != 0).","commonSituations":"Developers running the dev agent under their own account; CI runners without privileged mode; systemd units lacking User=root.","solutions":["Run the agent with sudo or as root.","Configure the service (systemd unit, container) to run as root.","Use non-connect -dev mode if root is not possible."],"exampleFix":"# before\nnomad agent -dev-connect\n# after\nsudo nomad agent -dev-connect","handlingStrategy":"validation","validationCode":"if os.Geteuid() != 0 {\n  return errors.New(\"-dev-connect requires root (network namespaces)\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check euid before launching with -dev-connect","Grant CI jobs privileged/root mode when testing connect","Document the root requirement in dev scripts"],"tags":["linux","permissions","root","dev-connect"],"backgroundTag":"insufficient-privileges","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}