{"record":{"id":"c6b0a5d5ec9242ef","repo":"hashicorp/nomad","slug":"cannot-apply-allowed-modes-configuration-q-is-no-c6b0a5","errorCode":null,"errorMessage":"cannot apply allowed_modes configuration, %q is not a valid userns_mode","messagePattern":"cannot apply allowed_modes configuration, %q is not a valid userns_mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/config.go","lineNumber":898,"sourceCode":"\tif len(allowedNS.PID) > 0 {\n\t\tfor _, v := range allowedNS.PID {\n\t\t\tif !containerapi.PidMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid pid_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\tif len(allowedNS.IPC) > 0 {\n\t\tfor _, v := range allowedNS.IPC {\n\t\t\tif !containerapi.IpcMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid ipc_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(allowedNS.Userns) > 0 {\n\t\tfor _, v := range allowedNS.Userns {\n\t\t\tif !containerapi.UsernsMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid userns_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(allowedNS.UTS) > 0 {\n\t\tfor _, v := range allowedNS.UTS {\n\t\t\tif !containerapi.UTSMode(v).Valid() {\n\t\t\t\treturn fmt.Errorf(\"cannot apply allowed_modes configuration, %q is not a valid utc_mode\", v)\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":880,"sourceCodeEnd":912,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/config.go#L880-L912","documentation":"During allowed_modes validation, each userns_mode allowlist entry is checked with containerapi.UsernsMode(v).Valid(). Only \"\" and \"host\" are valid userns modes, so any other string fails plugin setup with this error.","triggerScenarios":"Setting userns_modes = [\"host\", \"something-else\"] in the docker plugin allowlist, where the second value is not \"\" or \"host\".","commonSituations":"Operators assume arbitrary user-namespace strings are allowed (e.g. 'keep-id' from podman, 'auto'), but Docker's userns_mode only accepts host or empty.","solutions":["Restrict userns_modes entries to \"host\" (or empty string).","Remove podman-style values like 'keep-id'/'auto' — they are not valid Docker userns_mode values.","If per-user remap is needed, configure daemon-level userns-remap instead of the task driver allowlist.","Re-run agent config validation after fixing."],"exampleFix":"// before\nuserns_modes = [\"keep-id\"]\n// after\nuserns_modes = [\"host\"]","handlingStrategy":"validation","validationCode":"func validUserns(v string) bool { return v == \"\" || v == \"host\" }\nfor _, m := range cfg.AllowedModes.Userns {\n    if !validUserns(m) { return fmt.Errorf(\"invalid userns_mode %q\", m) }\n}","typeGuard":null,"tryCatchPattern":"Catch and reject the config at deploy time; the fix is always limiting entries to \"\" or \"host\".","preventionTips":["userns_mode only supports \"\" and \"host\" in Docker — nothing else.","Use daemon-level userns-remap for user namespace needs instead of allowlists.","Document the restriction in your platform's driver config guide."],"tags":["config","docker","validation","userns"],"backgroundTag":"invalid-config-allowlist-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}