{"record":{"id":"cb57220805f034ef","repo":"hashicorp/nomad","slug":"failed-to-lookup-user-v","errorCode":null,"errorMessage":"Failed to lookup user: %v","messagePattern":"Failed to lookup user: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocdir/task_dir.go","lineNumber":181,"sourceCode":"\t\t}\n\t}\n\n\tif err := t.MakeSecretsDirs(); err != nil {\n\t\treturn err\n\t}\n\n\t// Build chroot if chroot filesystem isolation is going to be used\n\tif fsi == fsisolation.Chroot {\n\t\tif err := t.buildChroot(chroot); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Only bind mount the task alloc/task dirs to the client.mounts_dir/<task>\n\tif fsi == fsisolation.Unveil {\n\t\tuid, gid, _, err := dynamic.LookupUser(username)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup user: %v\", err)\n\t\t}\n\n\t\tnobodyUID, nobodyGID, _, err := dynamic.LookupUser(\"nobody\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to lookup nobody user: %v\", err)\n\t\t}\n\n\t\t// create the task unique directory under the client mounts path\n\t\tparent := filepath.Dir(t.MountsAllocDir)\n\t\tif err = os.MkdirAll(parent, fileMode710); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to create task mount directory: %v\", err)\n\t\t}\n\t\tif err = os.Chown(parent, uid, gid); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to chown task mount directory: %v\", err)\n\t\t}\n\n\t\t// create the taskdir mount point\n\t\tif err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocdir/task_dir.go#L163-L199","documentation":"In TaskDir.Build for Unveil-based filesystem isolation (BSD/Unveil sandboxing path), Nomad resolves the task's username with dynamic.LookupUser to bind-mount the task dirs under client.mounts_dir/<task>. This error wraps the user lookup failure, aborting Build because the task's uid/gid cannot be determined.","triggerScenarios":"fsi == fsisolation.Unveil and dynamic.LookupUser(username) failed — the configured task user does not exist on the client host (or in its NSS sources).","commonSituations":"Jobspec sets a `user` that only exists in a container image, not on the host; typo in the user field; host provisioned without the service account; LDAP/NSS outage preventing resolution.","solutions":["Verify the user exists on the client host: `getent passwd <username>`; create it if missing.","Correct the `user` field in the job's task/group configuration if it is a typo.","Fix host NSS/LDAP configuration if lookups are delegated and currently failing.","Rerun the allocation after the user is resolvable."],"exampleFix":"// before: jobspec references host-missing user\ntask \"web\" {\n  user = \"webapp\"\n}\n// after: create the user on the Nomad client host\nsudo useradd -r -s /usr/sbin/nologin webapp","handlingStrategy":"validation","validationCode":"// validate the jobspec user resolves on the client host before submitting\nfunc ensureUser(name string) error {\n    if _, err := user.Lookup(name); err != nil {\n        return fmt.Errorf(\"task user %q not resolvable on client: %w\", name, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := td.Build(); err != nil {\n    if strings.Contains(err.Error(), \"Failed to lookup user\") {\n        log.Printf(\"create the task user on the client host or fix jobspec 'user' field: %v\", err)\n    }\n    return err\n}","preventionTips":["Provision any service accounts referenced in jobspecs on all Nomad clients (config management).","Remember the `user` field refers to host users, not image users.","Add `getent passwd <user>` checks to client startup health checks."],"tags":["users","mount","unveil","nomad"],"backgroundTag":"user-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}