{"record":{"id":"c57e55b4ad4e49b6","repo":"hashicorp/nomad","slug":"ipc-mode-must-be-q-or-q-got-q","errorCode":null,"errorMessage":"ipc_mode must be %q or %q, got %q","messagePattern":"ipc_mode must be %q or %q, got %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":229,"sourceCode":"\n\t// CapDrop is a set of linux capabilities to disable.\n\tCapDrop []string `codec:\"cap_drop\"`\n\n\t// WorkDir is the working directory inside the chroot\n\tWorkDir string `codec:\"work_dir\"`\n}\n\nfunc (tc *TaskConfig) validate() error {\n\tswitch tc.ModePID {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)\n\t}\n\n\tswitch tc.ModeIPC {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)\n\t}\n\n\tsupported := capabilities.Supported()\n\tbadAdds := supported.Difference(capabilities.New(tc.CapAdd))\n\tif !badAdds.Empty() {\n\t\treturn fmt.Errorf(\"cap_add configured with capabilities not supported by system: %s\", badAdds)\n\t}\n\n\tbadDrops := supported.Difference(capabilities.New(tc.CapDrop))\n\tif !badDrops.Empty() {\n\t\treturn fmt.Errorf(\"cap_drop configured with capabilities not supported by system: %s\", badDrops)\n\t}\n\n\tif tc.WorkDir != \"\" && !filepath.IsAbs(tc.WorkDir) {\n\t\treturn fmt.Errorf(\"work_dir must be absolute but got relative path %q\", tc.WorkDir)\n\t}\n\n\treturn nil","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L211-L247","documentation":"TaskConfig.validate() rejects a task whose ModeIPC (ipc_mode) is not \"\", \"private\", or \"host\". Like pid_mode, an unset value inherits the driver default; unsupported values mean the executor cannot construct the IPC namespace, so validation fails.","triggerScenarios":"Job submission with task config ipc_mode set to something other than \"private\", \"host\", or \"\" (Docker-style \"shareable\", \"container:<id>\", case mistakes, typos).","commonSituations":"Migrating Docker jobs to exec; using ipc_mode = \"shareable\" from Docker conventions; HCL typos.","solutions":["Set ipc_mode to \"private\" or \"host\" or remove it","Remove Docker-only IPC modes","Correct lowercase spelling"],"exampleFix":"// before\nconfig {\n  ipc_mode = \"shareable\"\n}\n// after\nconfig {\n  ipc_mode = \"host\"\n}","handlingStrategy":"validation","validationCode":"if !(tc.ModeIPC == \"\" || tc.ModeIPC == \"private\" || tc.ModeIPC == \"host\") {\n  return fmt.Errorf(\"invalid ipc_mode %q\", tc.ModeIPC)\n}","typeGuard":"func validIpcMode(v string) bool {\n  return v == \"\" || v == \"private\" || v == \"host\"\n}","tryCatchPattern":"if err := task.Validate(); err != nil {\n  if strings.Contains(err.Error(), \"ipc_mode\") {\n    cfg.ModeIPC = \"\"\n  }\n  return err\n}","preventionTips":["Omit ipc_mode to inherit the driver default","Validate jobs with nomad job validate pre-submit","Keep docker and exec driver task configs separate"],"tags":["nomad","exec-driver","task-config","validation"],"backgroundTag":"invalid-driver-config","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}