{"record":{"id":"bb5cdadaf375633a","repo":"hashicorp/nomad","slug":"failed-to-lookup-nobody-user-v","errorCode":null,"errorMessage":"Failed to lookup nobody user: %v","messagePattern":"Failed to lookup nobody user: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocdir/task_dir.go","lineNumber":186,"sourceCode":"\t}\n\n\t// Build chroot if chroot filesystem isolation is going to be used\n\tif fsi == fsisolation.Chroot {\n\t\tif err := t.buildChroot(chroot); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Only bind mount the task alloc/task dirs to the client.mounts_dir/<task>\n\tif fsi == fsisolation.Unveil {\n\t\tuid, gid, _, err := dynamic.LookupUser(username)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup user: %v\", err)\n\t\t}\n\n\t\tnobodyUID, nobodyGID, _, err := dynamic.LookupUser(\"nobody\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup nobody user: %v\", err)\n\t\t}\n\n\t\t// create the task unique directory under the client mounts path\n\t\tparent := filepath.Dir(t.MountsAllocDir)\n\t\tif err = os.MkdirAll(parent, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to create task mount directory: %v\", err)\n\t\t}\n\t\tif err = os.Chown(parent, uid, gid); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to chown task mount directory: %v\", err)\n\t\t}\n\n\t\t// create the taskdir mount point\n\t\tif err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to mount task dir: %v\", err)\n\t\t}\n\n\t\t// create the allocdir mount point (owned by nobody)\n\t\tif err = mountDir(filepath.Join(t.AllocDir, \"/alloc\"), t.MountsAllocDir, nobodyUID, nobodyGID, fileMode777); err != nil {","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocdir/task_dir.go#L168-L204","documentation":"TaskDir.Build (Unveil fs-isolation mode) resolves the task's runtime user and the 'nobody' account with dynamic.LookupUser to set ownership on bind-mount points. This error wraps the failure of the 'nobody' user lookup on the host. Nomad requires a local 'nobody' user whenever Unveil isolation mounts the shared alloc dir, because the alloc share is chowned to nobody:nobody.","triggerScenarios":"Calling TaskDir.Build with fsi == fsisolation.Unveil on a host where the 'nobody' passwd entry does not exist or the user database is unreadable; dynamic.LookupUser(\"nobody\") returns an error.","commonSituations":"Minimal container images (distroless, scratch, alpine variants) or stripped-down hosts without a /etc/passwd 'nobody' entry; NSS misconfiguration (e.g. broken /etc/nsswitch.conf) preventing passwd resolution; running the Nomad client in a userns/container that hides system users.","solutions":["Add the 'nobody' user to the host (e.g. `useradd -u 65534 nobody` or ensure the distro's shadow/nss package provides it)","Verify /etc/passwd contains a nobody entry and /etc/nsswitch.conf has `passwd: files` (or a working NSS backend)","If running the client in a container, ensure /etc/passwd is mounted/contains nobody","Upgrade Nomad or pin to a chroot/image-based isolation driver if Unveil mode is not required"],"exampleFix":"# before (host lacks nobody)\n$ getent passwd nobody  # empty\n# after\n$ useradd -u 65534 -g nogroup -s /sbin/nologin nobody\n$ getent passwd nobody\nnobody:x:65534:65534:nobody:/nonexistent:/sbin/nologin","handlingStrategy":"validation","validationCode":"if out, err := exec.Command(\"getent\", \"passwd\", \"nobody\").Output(); err != nil || len(out) == 0 {\n    return fmt.Errorf(\"host missing 'nobody' user required for Unveil isolation: %w\", err)\n}","typeGuard":"func hasNobodyUser() bool {\n    _, err := user.Lookup(\"nobody\")\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Use standard base images/distros that ship the nobody user","Assert nobody exists in node provisioning/terraform before joining the client","Keep /etc/nsswitch.conf with passwd: files","Document Unveil mode's host requirements"],"tags":["filesystem","user-lookup","nomad-client"],"backgroundTag":"user-lookup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}