{"record":{"id":"e19fb461b595769d","repo":"hashicorp/nomad","slug":"cannot-apply-q-configuration","errorCode":null,"errorMessage":"cannot apply %q configuration","messagePattern":"cannot apply %q configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":2188,"sourceCode":"\nfunc (d *Driver) validateNamespace(allowedModes []string, field string, desiredNs string) error {\n\t// return early if allow_privileged is configured or\n\t// if the desiredNs is empty\n\tif d.config.AllowPrivileged {\n\t\treturn nil\n\t}\n\tif desiredNs == \"\" {\n\t\treturn nil\n\t}\n\n\tfor _, v := range allowedModes {\n\t\t// return if the desired namespace matches a value in allowedModes\n\t\tif glob.Glob(v, desiredNs) {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn fmt.Errorf(\"cannot apply %q configuration\", field)\n}\n","sourceCodeStart":2170,"sourceCodeEnd":2190,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L2170-L2190","documentation":"The docker driver validates namespace-related driver config fields (e.g. allowed privileged/sysctl namespaces) against a whitelist of glob patterns (allowedModes). This error means the requested configuration value did not match any allowed glob, so the driver refuses to apply it.","triggerScenarios":"A docker driver config field (e.g. a sysctl or namespace mode such as 'ipc', 'pid', 'network' settings) is set to a value that fails every glob.Glob(v, desiredNs) match in allowedModes; validateConfig/driver setup then returns this error naming the offending field.","commonSituations":"Requesting a namespace mode not on the host's allowed list (e.g. host networking or privileged namespaces restricted by the Nomad agent config); operator tightened allowed_modes in the client config while jobs still request old values; case/format mismatch between requested value and whitelist patterns.","solutions":["Change the field's value to one that matches an entry in the driver's allowed list (check the Nomad client 'docker' config / allowed_modes).","Ask the cluster operator to add the desired namespace pattern to allowedModes in the agent configuration.","Run 'nomad node status -verbose' / inspect the client config to see which modes are permitted before scheduling."],"exampleFix":"// before (job task driver config)\n sysctl { \"net.ipv4.ip_unprivileged_port_start\" = \"80\" } // not in allowed list\n// after\n sysctl { \"net.ipv4.ip_unprivileged_port_start\" = \"1024\" } // allowed by glob whitelist","handlingStrategy":"validation","validationCode":"// Before submitting, check the field against the client's allowed modes\nallowed := []string{\"bridge\", \"host\"} // mirror allowedModes from agent config\nif !slices.Contains(allowed, requestedMode) {\n    return fmt.Errorf(\"mode %q not in allowed list %v\", requestedMode, allowed)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep job driver configs in sync with the Nomad client's allowed lists.","Test job specs against a staging client with the same agent config.","Coordinate with operators before relying on privileged namespace settings."],"tags":["docker-driver","config-validation","namespace"],"backgroundTag":"config-value-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}