{"record":{"id":"a0a5bd911315868b","repo":"hashicorp/nomad","slug":"cap-add-configured-with-capabilities-not-supported","errorCode":null,"errorMessage":"cap_add configured with capabilities not supported by system: %s","messagePattern":"cap_add configured with capabilities not supported by system: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":235,"sourceCode":"}\n\nfunc (tc *TaskConfig) validate() error {\n\tswitch tc.ModePID {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)\n\t}\n\n\tswitch tc.ModeIPC {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)\n\t}\n\n\tsupported := capabilities.Supported()\n\tbadAdds := supported.Difference(capabilities.New(tc.CapAdd))\n\tif !badAdds.Empty() {\n\t\treturn fmt.Errorf(\"cap_add configured with capabilities not supported by system: %s\", badAdds)\n\t}\n\n\tbadDrops := supported.Difference(capabilities.New(tc.CapDrop))\n\tif !badDrops.Empty() {\n\t\treturn fmt.Errorf(\"cap_drop configured with capabilities not supported by system: %s\", badDrops)\n\t}\n\n\tif tc.WorkDir != \"\" && !filepath.IsAbs(tc.WorkDir) {\n\t\treturn fmt.Errorf(\"work_dir must be absolute but got relative path %q\", tc.WorkDir)\n\t}\n\n\treturn nil\n}\n\n// TaskState is the state which is encoded in the handle returned in\n// StartTask. This information is needed to rebuild the task state and handler\n// during recovery.\ntype TaskState struct {","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L217-L253","documentation":"TaskConfig.validate() checks each entry in cap_add against capabilities.Supported(); any capability the host kernel doesn't support causes the task to be rejected. This stops tasks from requesting privileges the system cannot enforce or grant.","triggerScenarios":"Task config with cap_add containing an unknown/unsupported capability name (typo, unsupported on kernel, or name not present in the host's bounding set reported by capabilities.Supported()).","commonSituations":"Running on kernels older than a capability's introduction; typos like \"CAP_NET_ADMIN\" vs \"net_admin\" mismatch; exec-in-exec environments where the bounding set is reduced.","solutions":["Remove or correct the unsupported capability listed in the error","Check `capsh --print` on the client to see the host's supported capabilities","Use a client constraint to place the job on hosts supporting the needed caps"],"exampleFix":"// before\nconfig {\n  cap_add = [\"CAP_SYS_PTRACE\"]\n}\n// after\nconfig {\n  cap_add = []\n}","handlingStrategy":"validation","validationCode":"for _, c := range tc.CapAdd {\n  if !hostSupportedCaps[c] {\n    return fmt.Errorf(\"cap_add unsupported: %s\", c)\n  }\n}","typeGuard":"func capsSupported(caps []string) bool {\n  return capabilities.Supported().Difference(capabilities.New(caps)).Empty()\n}","tryCatchPattern":"if err := task.Validate(); err != nil {\n  if strings.Contains(err.Error(), \"cap_add\") {\n    cfg.CapAdd = nil\n  }\n  return err\n}","preventionTips":["Match capability names exactly as supported by the host","Audit host kernel versions in the fleet before requesting newer caps","Use constraints to schedule cap-heavy tasks onto capable clients"],"tags":["nomad","exec-driver","capabilities","task-config"],"backgroundTag":"unsupported-capability-requested","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}