{"record":{"id":"aca7bc9a4684078f","repo":"hashicorp/nomad","slug":"allow-caps-configured-with-capabilities-not-suppor","errorCode":null,"errorMessage":"allow_caps configured with capabilities not supported by system: %s","messagePattern":"allow_caps configured with capabilities not supported by system: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":187,"sourceCode":"\tDeniedHostGids string `codec:\"denied_host_gids\"`\n}\n\nfunc (c *Config) validate() error {\n\tswitch c.DefaultModePID {\n\tcase executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"default_pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)\n\t}\n\n\tswitch c.DefaultModeIPC {\n\tcase executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"default_ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)\n\t}\n\n\tbadCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))\n\tif !badCaps.Empty() {\n\t\treturn fmt.Errorf(\"allow_caps configured with capabilities not supported by system: %s\", badCaps)\n\t}\n\n\treturn nil\n}\n\n// TaskConfig is the driver configuration of a task within a job\ntype TaskConfig struct {\n\t// Command is the thing to exec.\n\tCommand string `codec:\"command\"`\n\n\t// Args are passed along to Command.\n\tArgs []string `codec:\"args\"`\n\n\t// ModePID indicates whether PID namespace isolation is enabled for the task.\n\t// Must be \"private\" or \"host\" if set.\n\tModePID string `codec:\"pid_mode\"`\n\n\t// ModeIPC indicates whether IPC namespace isolation is enabled for the task.","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L169-L205","documentation":"During plugin config validation the driver computes capabilities.Supported().Difference(capabilities.New(c.AllowCaps)); if any capability in allow_caps is not supported by the host kernel, validation fails. This prevents advertising driver-level capabilities the system cannot grant.","triggerScenarios":"SetConfig -> validate() when driverConfig.AllowCaps contains a capability string not in the host's supported set (e.g. CAP_SYS_ADMIN unsupported or misspelled like \"NET_ADMIN \" with whitespace or missing CAP_ prefix mismatch).","commonSituations":"Older kernels lacking newer capabilities; typos in capability names; copying Docker capability lists that include names the host doesn't support; running inside containers/VMs with restricted capability sets.","solutions":["Run with only host-supported capabilities; check the error message for the offending list and remove/fix those entries","Verify supported caps with `capsh --print` or by inspecting capabilities.Supported()","Fix capability name spelling/prefixing"],"exampleFix":"// before\nconfig {\n  allow_caps = [\"CAP_SYS_ADMIN\", \"CAP_NET_ADMIN\"]\n}\n// after\nconfig {\n  allow_caps = [\"CAP_NET_ADMIN\"]\n}","handlingStrategy":"validation","validationCode":"supported := map[string]bool{ \"CAP_CHOWN\":true, \"CAP_DAC_OVERRIDE\":true, /* fill from capabilities.Supported() on target host */ }\nfor _, c := range cfg.AllowCaps {\n  if !supported[c] {\n    return fmt.Errorf(\"unsupported cap: %s\", c)\n  }\n}","typeGuard":"func allCapsSupported(caps []string, supported func() capabilities.Set) bool {\n  return supported().Difference(capabilities.New(caps)).Empty()\n}","tryCatchPattern":"if err := driver.SetConfig(cfg); err != nil {\n  if strings.Contains(err.Error(), \"allow_caps\") {\n    log.Printf(\"fix allow_caps: %v\", err)\n  }\n  return err\n}","preventionTips":["Check host capability support (capsh --print) before advertising allow_caps","Use the default allow_caps unless you specifically need more","Keep capability lists short and reviewed to avoid typos"],"tags":["nomad","exec-driver","capabilities","configuration"],"backgroundTag":"unsupported-capability-requested","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}