{"record":{"id":"d1fbf42b7b487c68","repo":"hashicorp/nomad","slug":"default-ipc-mode-must-be-q-or-q-got-q","errorCode":null,"errorMessage":"default_ipc_mode must be %q or %q, got %q","messagePattern":"default_ipc_mode must be %q or %q, got %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":182,"sourceCode":"\t// AllowCaps configures which Linux Capabilities are enabled for tasks\n\t// running on this node.\n\tAllowCaps []string `codec:\"allow_caps\"`\n\n\tDeniedHostUids string `codec:\"denied_host_uids\"`\n\tDeniedHostGids string `codec:\"denied_host_gids\"`\n}\n\nfunc (c *Config) validate() error {\n\tswitch c.DefaultModePID {\n\tcase executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"default_pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)\n\t}\n\n\tswitch c.DefaultModeIPC {\n\tcase executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"default_ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)\n\t}\n\n\tbadCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))\n\tif !badCaps.Empty() {\n\t\treturn fmt.Errorf(\"allow_caps configured with capabilities not supported by system: %s\", badCaps)\n\t}\n\n\treturn nil\n}\n\n// TaskConfig is the driver configuration of a task within a job\ntype TaskConfig struct {\n\t// Command is the thing to exec.\n\tCommand string `codec:\"command\"`\n\n\t// Args are passed along to Command.\n\tArgs []string `codec:\"args\"`\n","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L164-L200","documentation":"The exec driver's Validate() rejects plugin-level configurations whose DefaultModeIPC is not exactly \"private\" or \"host\". These are the only IPC isolation modes the underlying executor supports (they map to executor.IsolationModePrivate/IsolationModeHost). Any other value means Nomad would not know how to set up the task's IPC namespace, so validation fails before any task runs.","triggerScenarios":"SetConfig -> validate() runs when the exec driver plugin config is loaded; it fires whenever driverConfig.DefaultModeIPC is set to a string other than \"private\" or \"host\" (typo, wrong case like \"Private\", or a Docker-style value like \"none\" or \"container:<id>\").","commonSituations":"Operators copying Docker IPC options (none, container:xxx) into the Nomad exec driver block; typos in client HCL config; host agent config templates with misspelled keys; upgrading from other runtimes with different isolation vocabularies.","solutions":["Set default_ipc_mode to exactly \"private\" or \"host\" in the plugin config, or remove the option to use the default","Fix casing/typos (values are lowercase)","Remove Docker-only IPC modes (none, container:...) which exec does not support"],"exampleFix":"// before\nplugin \"exec\" {\n  config {\n    default_ipc_mode = \"none\"\n  }\n}\n// after\nplugin \"exec\" {\n  config {\n    default_ipc_mode = \"private\"\n  }","handlingStrategy":"validation","validationCode":"valid := []string{\"private\", \"host\"}\nfor _, m := range valid {\n  if cfg.DefaultModeIPC == m {\n    return true\n  }\n}\nreturn false","typeGuard":"func isValidIPCMode(v string) bool {\n  return v == \"private\" || v == \"host\"\n}","tryCatchPattern":"if err := driver.SetConfig(cfg); err != nil {\n  if strings.Contains(err.Error(), \"default_ipc_mode\") {\n    cfg.DefaultModeIPC = \"private\"\n    err = driver.SetConfig(cfg)\n  }\n  return err\n}","preventionTips":["Only use documented values: private or host","Validate client HCL with nomad agent config validation before deploy","Never copy Docker IPC mode values into exec driver config"],"tags":["nomad","exec-driver","configuration","validation"],"backgroundTag":"invalid-driver-config","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}