{"record":{"id":"e200437b5ed37570","repo":"hashicorp/nomad","slug":"cap-drop-configured-with-capabilities-not-supporte","errorCode":null,"errorMessage":"cap_drop configured with capabilities not supported by system: %s","messagePattern":"cap_drop configured with capabilities not supported by system: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/exec/driver.go","lineNumber":240,"sourceCode":"\tdefault:\n\t\treturn fmt.Errorf(\"pid_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)\n\t}\n\n\tswitch tc.ModeIPC {\n\tcase \"\", executor.IsolationModePrivate, executor.IsolationModeHost:\n\tdefault:\n\t\treturn fmt.Errorf(\"ipc_mode must be %q or %q, got %q\", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)\n\t}\n\n\tsupported := capabilities.Supported()\n\tbadAdds := supported.Difference(capabilities.New(tc.CapAdd))\n\tif !badAdds.Empty() {\n\t\treturn fmt.Errorf(\"cap_add configured with capabilities not supported by system: %s\", badAdds)\n\t}\n\n\tbadDrops := supported.Difference(capabilities.New(tc.CapDrop))\n\tif !badDrops.Empty() {\n\t\treturn fmt.Errorf(\"cap_drop configured with capabilities not supported by system: %s\", badDrops)\n\t}\n\n\tif tc.WorkDir != \"\" && !filepath.IsAbs(tc.WorkDir) {\n\t\treturn fmt.Errorf(\"work_dir must be absolute but got relative path %q\", tc.WorkDir)\n\t}\n\n\treturn nil\n}\n\n// TaskState is the state which is encoded in the handle returned in\n// StartTask. This information is needed to rebuild the task state and handler\n// during recovery.\ntype TaskState struct {\n\tReattachConfig *pstructs.ReattachConfig\n\tTaskConfig     *drivers.TaskConfig\n\tPid            int\n\tStartedAt      time.Time\n}","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/exec/driver.go#L222-L258","documentation":"TaskConfig.validate() also validates cap_drop against the same supported set; a cap_drop entry naming a capability the host doesn't recognize fails validation, because the driver cannot guarantee consistent drop semantics across hosts.","triggerScenarios":"Task config cap_drop containing a capability string absent from capabilities.Supported() (typo, wrong prefix, kernel lacking the capability).","commonSituations":"Hardening templates with long drop lists copied from Docker docs including unsupported names; typos like \"CAP_MKNOD\" misspelled; cross-version kernel differences.","solutions":["Remove or fix the offending cap_drop entry per the error message","Align drop lists with capabilities.Supported()","Keep drop lists minimal to reduce typo risk"],"exampleFix":"// before\nconfig {\n  cap_drop = [\"CAP_SETFCAP_TYPO\"]\n}\n// after\nconfig {\n  cap_drop = [\"CAP_SETFCAP\"]\n}","handlingStrategy":"validation","validationCode":"for _, c := range tc.CapDrop {\n  if !hostSupportedCaps[c] {\n    return fmt.Errorf(\"cap_drop unsupported: %s\", c)\n  }\n}","typeGuard":"func dropsSupported(drops []string) bool {\n  return capabilities.Supported().Difference(capabilities.New(drops)).Empty()\n}","tryCatchPattern":"if err := task.Validate(); err != nil {\n  if strings.Contains(err.Error(), \"cap_drop\") {\n    cfg.CapDrop = nil\n  }\n  return err\n}","preventionTips":["Derive drop lists from capabilities.Supported() rather than hand-writing","Lint job templates for capability name typos","Keep hardening lists minimal and reviewed"],"tags":["nomad","exec-driver","capabilities","task-config"],"backgroundTag":"unsupported-capability-requested","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}