{"record":{"id":"a0d2e2dbb0f63c9e","repo":"hashicorp/nomad","slug":"failed-to-identify-user-v-v","errorCode":null,"errorMessage":"failed to identify user %v: %v","messagePattern":"failed to identify user (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor_unix.go","lineNumber":64,"sourceCode":"// necessarily kill it.\nfunc (e *UniversalExecutor) shutdownProcess(sig os.Signal, proc *os.Process) error {\n\tif sig == nil {\n\t\tsig = os.Interrupt\n\t}\n\n\tif err := proc.Signal(sig); err != nil && err.Error() != finishedErr {\n\t\treturn fmt.Errorf(\"executor shutdown error: %v\", err)\n\t}\n\n\treturn nil\n}\n\n// setCmdUser takes a user id as a string and looks up the user, and sets the command\n// to execute as that user.\nfunc setCmdUser(cmd *exec.Cmd, userid string) error {\n\tu, err := users.Lookup(userid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to identify user %v: %v\", userid, err)\n\t}\n\n\t// Get the groups the user is a part of\n\tgidStrings, err := u.GroupIds()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to lookup user's group membership: %v\", err)\n\t}\n\n\tgids := make([]uint32, len(gidStrings))\n\tfor _, gidString := range gidStrings {\n\t\tu, err := strconv.ParseUint(gidString, 10, 32)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to convert user's group to uint32 %s: %v\", gidString, err)\n\t\t}\n\n\t\tgids = append(gids, uint32(u))\n\t}\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor_unix.go#L46-L82","documentation":"setCmdUser resolves a username/uid string to a system user via users.Lookup before exec'ing a task command. When the lookup fails (user does not exist, NSS misconfiguration, or the executor lacks permission to query the user database), it wraps the underlying error. This is the Unix path of Nomad's executor user-impersonation setup.","triggerScenarios":"Calling executor setup with a task 'user' value that does not resolve: unknown username, numeric uid absent from /etc/passwd, or a users.Lookup failure (e.g. broken NSS/SSSD, /etc/passwd unreadable in a chroot/container).","commonSituations":"Task stanza references a user not created in the task's image or host; running Nomad in a minimal container without /etc/passwd entries; LDAP/SSSD down so NSS lookups fail; typo'd username in job spec.","solutions":["Verify the user exists on the host: run 'id <userid>' (or 'getent passwd <userid>') as the user Nomad runs as.","Fix /etc/nsswitch.conf or restart sssd/nscd if name-service lookups are failing for valid users.","Ensure /etc/passwd and /etc/group exist and are readable inside the container/chroot the executor runs in.","Correct the task's user field in the job spec (e.g. change 'nobodyx' to 'nobody')."],"exampleFix":"// before (job.hcl)\nuser = \"appuser\"\n// after: ensure the user exists (e.g. in the image Dockerfile)\nRUN useradd -r -u 1005 appuser","handlingStrategy":"validation","validationCode":"// Go: verify the user resolves before submitting the job\nif _, err := user.Lookup(taskUser); err != nil {\n    return fmt.Errorf(\"task user %q does not resolve on this host: %w\", taskUser, err)\n}","typeGuard":"func userResolves(userid string) bool {\n    _, err := user.Lookup(userid)\n    return err == nil\n}","tryCatchPattern":"if err := exec.SetUser(cmd, userid); err != nil {\n    var uerr users.UnknownUserError\n    if errors.As(err, &uerr) {\n        // invalid user config: surface actionable message\n    }\n    return fmt.Errorf(\"executor set user failed: %w\", err)\n}","preventionTips":["Run 'id <user>' on every client host before rolling out jobs referencing that user.","Create task users in the image/AMI or via provisioning, not at runtime.","Keep /etc/passwd and /etc/nsswitch.conf intact in containers running exec tasks.","Prefer numeric uids that exist in /etc/passwd for minimal images."],"tags":["unix","user-lookup","exec","nomad-executor"],"backgroundTag":"user-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}