{"record":{"id":"dd16b05481874af5","repo":"hashicorp/nomad","slug":"cap-add-configured-with-capabilities-not-supported-dd16b0","errorCode":null,"errorMessage":"cap_add configured with capabilities not supported by system: %s","messagePattern":"cap_add configured with capabilities not supported by system: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/java/driver.go","lineNumber":215,"sourceCode":"\nfunc (tc *TaskConfig) validate() error {\n\tswitch tc.ModePID {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)\n\n\t}\n\n\tswitch tc.ModeIPC {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)\n\t}\n\n\tsupported := capabilities.Supported()\n\tbadAdds := supported.Difference(capabilities.New(tc.CapAdd))\n\tif !badAdds.Empty() {\n\t\treturn fmt.Errorf(\"cap_add configured with capabilities not supported by system: %s\", badAdds)\n\t}\n\tbadDrops := supported.Difference(capabilities.New(tc.CapDrop))\n\tif !badDrops.Empty() {\n\t\treturn fmt.Errorf(\"cap_drop configured with capabilities not supported by system: %s\", badDrops)\n\t}\n\n\tif tc.WorkDir != \"\" && !filepath.IsAbs(tc.WorkDir) {\n\t\treturn fmt.Errorf(\"work_dir must be an absolute path: %s\", tc.WorkDir)\n\t}\n\treturn nil\n}\n\n// TaskState is the state which is encoded in the handle returned in\n// StartTask. This information is needed to rebuild the taskConfig state and handler\n// during recovery.\ntype TaskState struct {\n\tReattachConfig *pstructs.ReattachConfig\n\tTaskConfig     *drivers.TaskConfig","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/java/driver.go#L197-L233","documentation":"This error is thrown by the Nomad Java driver during task config validation when the cap_add field lists Linux capabilities that the host kernel/system does not support. The driver computes the set of capabilities supported on the system (capabilities.Supported()) and takes its difference with the requested set; any leftover capabilities are reported. This prevents starting tasks that would silently fail or be rejected later by the executor.","triggerScenarios":"A task's drivers.java config (via the TaskConfig's CapAdd field) names a capability not in the system's supported set, e.g. a typo like CAP_NET_ADMN or a capability unavailable on the host kernel, found when taskConfig.validate() runs in StartTask or ValidateTask.","commonSituations":"Typos in capability names; copying configs between hosts with different kernel versions or seccomp/apparmor restrictions; running Nomad in containers/VMs with a reduced capability set; using newer capabilities (e.g. CAP_CHECKPOINT_RESTORE) on older kernels.","solutions":["Remove or correct the unsupported capability names in the task's cap_add field","Check which capabilities the host supports (e.g. 'capsh --print' or compare with capabilities.Supported()) and align the config","If the capability is genuinely needed, move the workload to a host whose kernel supports it","Update Nomad/its capability list if the capability exists but the vendored list is outdated"],"exampleFix":"// before\n-cap_add = [\"CAP_NET_ADMIN\", \"CAP_SYS_NICE\", \"CAP_NET_ADMN\"]\n// after\n-cap_add = [\"CAP_SYS_NICE\"]","handlingStrategy":"validation","validationCode":"import \"github.com/hashicorp/nomad/client/lib/capabilities\"\n\nfunc checkCapAdd(adds []string) error {\n    bad := capabilities.Supported().Difference(capabilities.New(adds))\n    if !bad.Empty() {\n        return fmt.Errorf(\"unsupported cap_add: %s\", bad)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep a vetted allowlist of capabilities per host class and generate job specs from it","Run 'nomad job validate' against the target cluster before submitting","Spell capabilities exactly as in the supported set and add CI checks against the driver schema","Pin capability-needing workloads to eligible nodes with matching kernels via constraints"],"tags":["nomad","java-driver","linux-capabilities","validation"],"backgroundTag":"unsupported-capability","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}