{"record":{"id":"bbc46a2448b3ceeb","repo":"hashicorp/nomad","slug":"filesystem-functions-disabled","errorCode":null,"errorMessage":"filesystem functions disabled","messagePattern":"filesystem functions disabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"jobspec2/functions.go","lineNumber":136,"sourceCode":"\t\tfuncs[\"sha1\"] = crypto.Sha1Func\n\t}\n\n\treturn funcs\n}\n\nfunc guardFS(allowFS bool, fn function.Function) function.Function {\n\tif allowFS {\n\t\treturn fn\n\t}\n\n\tspec := &function.Spec{\n\t\tParams:   fn.Params(),\n\t\tVarParam: fn.VarParam(),\n\t\tType: func([]cty.Value) (cty.Type, error) {\n\t\t\treturn cty.DynamicPseudoType, fmt.Errorf(\"filesystem function disabled\")\n\t\t},\n\t\tImpl: func([]cty.Value, cty.Type) (cty.Value, error) {\n\t\t\treturn cty.DynamicVal, fmt.Errorf(\"filesystem functions disabled\")\n\t\t},\n\t}\n\n\treturn function.New(spec)\n}\n","sourceCodeStart":118,"sourceCodeEnd":142,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/jobspec2/functions.go#L118-L142","documentation":"Same family as 2003 but thrown from the Impl (evaluation) path: when a disabled filesystem HCL function is actually invoked, evaluation returns 'filesystem functions disabled'. jobspec2 intentionally refuses filesystem access during job parsing.","triggerScenarios":"Calling a filesystem HCL function in a jobspec that passes type checking but fails at evaluation time because the function set was built with filesystem functions disabled.","commonSituations":"Reusing Terraform-style HCL that reads local files; teams migrating configs between tools; attempts to template job files with local file contents at submit time.","solutions":["Inline the file content directly in the jobspec or use a template stanza in the job.","Move the value into a variable and supply it via var-file/-var at parse time.","Use Nomad's artifact + template blocks to fetch and render content at runtime instead of parse time.","Preprocess the jobspec with your own tooling before submitting if file interpolation is required."],"exampleFix":"// before\ncommand = templatefile(\"app.tpl\", {})\n\n// after\ntemplate {\n  data     = file content inlined or via artifact\n  destination = \"local/app.tpl\"\n}","handlingStrategy":"validation","validationCode":"if strings.Contains(jobHCL, \"templatefile(\") || strings.Contains(jobHCL, \"file(\") {\n    return errors.New(\"filesystem functions are disabled in jobspec evaluation\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"filesystem functions disabled\") {\n    // replace the function call with a literal or template stanza\n}","preventionTips":["Preprocess templates outside HCL before submission.","Use Nomad template stanzas for runtime rendering.","Educate teams that jobspec HCL has no filesystem access."],"tags":["hcl","jobspec","filesystem","functions"],"backgroundTag":"function-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}