{"record":{"id":"99f6dc0237a71396","repo":"hashicorp/nomad","slug":"s-is-not-an-allowed-emulator","errorCode":null,"errorMessage":"'%s' is not an allowed emulator","messagePattern":"'(.+?)' is not an allowed emulator","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/qemu/driver.go","lineNumber":430,"sourceCode":"\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n\n// hardcoded list of drive interfaces, Qemu currently supports\nvar allowedDriveInterfaces = []string{\"ide\", \"scsi\", \"sd\", \"mtd\", \"floppy\", \"pflash\", \"virtio\", \"none\"}\n\nfunc isAllowedDriveInterface(driveInterface string) bool {\n\treturn slices.Contains(allowedDriveInterfaces, driveInterface)\n}\n\n// validateEmulator validate whether the specified emulator is in allowedEmulators\nfunc validateEmulator(emulator string, allowedEmulators []string) error {\n\tif len(allowedEmulators) > 0 {\n\t\tif !slices.Contains(allowedEmulators, emulator) {\n\t\t\treturn fmt.Errorf(\"'%s' is not an allowed emulator\", emulator)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateArgs ensures that all QEMU command line params are in the\n// allowlist. This function must be called after all interpolation has\n// taken place.\nfunc validateArgs(pluginConfigAllowList, args []string) error {\n\tif len(pluginConfigAllowList) > 0 {\n\t\tallowed := map[string]struct{}{}\n\t\tfor _, arg := range pluginConfigAllowList {\n\t\t\tallowed[arg] = struct{}{}\n\t\t}\n\t\tfor _, arg := range args {\n\t\t\tif strings.HasPrefix(strings.TrimSpace(arg), \"-\") {\n\t\t\t\tif _, ok := allowed[arg]; !ok {\n\t\t\t\t\treturn fmt.Errorf(\"%q is not in args_allowlist\", arg)","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/qemu/driver.go#L412-L448","documentation":"validateEmulator checks that the QEMU emulator binary requested via the driver's 'emulator' config (e.g. qemu-system-x86_64) is present in the operator-configured allowed_emulators list. Nomad throws this when a task requests an emulator the server admin has not allowlisted, because running arbitrary emulators would let a task execute unapproved binaries as the Nomad agent user.","triggerScenarios":"Calling StartTask (or the internal paths via findEmulators) where the task's driver config sets 'emulator' to a value not contained in the client's allowed_emulators list; note validation only runs when allowed_emulators is non-empty.","commonSituations":"Client config sets allowed_emulators = [\"qemu-system-x86_64\"] but the job specifies qemu-system-i386 or qemu-system-aarch64; operator tightened the allowlist after jobs were written; typo in the emulator name in the job file.","solutions":["Update the job's qemu driver 'emulator' option to match one of the values in the client's allowed_emulators list (check with 'nomad node status <node> -verbose' or the client.hcl).","Add the desired emulator to allowed_emulators in the Nomad client config and restart the client.","If no restriction is desired, remove allowed_emulators from the client config entirely — validation is skipped when the list is empty."],"exampleFix":"// job (before)\nconfig { emulator = \"qemu-system-aarch64\" image_path = \"...\" }\n// after (matching client allowlist)\nconfig { emulator = \"qemu-system-x86_64\" image_path = \"...\" }","handlingStrategy":"validation","validationCode":"const allowed := []string{\"qemu-system-x86_64\"} // mirror client's allowed_emulators\nif slices.Contains(allowed, cfg.Emulator) == false {\n    return fmt.Errorf(\"emulator %q must be one of %v\", cfg.Emulator, allowed)\n}","typeGuard":"func isAllowedEmulator(e string, allowed []string) bool {\n    return len(allowed) == 0 || slices.Contains(allowed, e)\n}","tryCatchPattern":"_, _, err := d.StartTask(cfg)\nif err != nil && strings.Contains(err.Error(), \"is not an allowed emulator\") {\n    // fix job emulator option or ask operator to widen allowed_emulators\n}","preventionTips":["Keep job emulator values in sync with the client's allowed_emulators list","Run 'nomad job validate' before submitting jobs","Document the allowlist for job authors","Use templating/shared vars to source the emulator name from one place"],"tags":["qemu","nomad","driver-config","allowlist"],"backgroundTag":"resource-not-in-allowlist","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}