{"record":{"id":"e61112d31916a784","repo":"hashicorp/nomad","slug":"v-s","errorCode":null,"errorMessage":"%v: %s","messagePattern":"%v: %s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/template/template_default.go","lineNumber":183,"sourceCode":"\nfunc ReaderFn(taskID, taskDir string, sandboxEnabled bool) func(string) ([]byte, error) {\n\tif !sandboxEnabled {\n\t\treturn nil\n\t}\n\tthisBin := subproc.Self()\n\n\treturn func(src string) ([]byte, error) {\n\n\t\tsandboxCfg := &sandboxConfig{\n\t\t\tthisBin:     thisBin,\n\t\t\tsandboxPath: taskDir,\n\t\t\tsourcePath:  src,\n\t\t\ttaskID:      taskID,\n\t\t}\n\n\t\tstdout, stderr, code, err := readTemplateFromSandbox(sandboxCfg)\n\t\tif err != nil && code != 0 {\n\t\t\treturn nil, fmt.Errorf(\"%v: %s\", err, string(stderr))\n\t\t}\n\n\t\t// this will get wrapped in CT log formatter\n\t\tfmt.Fprintf(os.Stderr, \"[DEBUG] %s\", string(stderr))\n\t\treturn stdout, nil\n\t}\n}\n","sourceCodeStart":165,"sourceCodeEnd":191,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/template/template_default.go#L165-L191","documentation":"This error wraps a template sandbox execution failure in Nomad's template runner. When readTemplateFromSandbox returns an error with a non-zero exit code, the raw stderr output from the template-rendering subprocess (consul-template) is appended to the error via fmt.Errorf. The developer sees both the underlying error and the subprocess's own diagnostic output.","triggerScenarios":"readTemplateFromSandbox fails AND the sandbox command exits with code != 0, e.g. the consul-template binary fails to render a template due to syntax errors, missing secrets, or consul/vault connectivity failures inside the task sandbox.","commonSituations":"Malformed template syntax, references to undefined variables, consul-template being unable to reach Consul/Vault agents from within the sandbox, or missing permissions on the sandbox directory.","solutions":["Read the stderr portion of the error — it contains consul-template's actual diagnostic","Validate template syntax locally with the consul-template CLI before deploying","Verify consul/vault blocks in the task and the client agent's consul/vault configs are correct","Check task logs for the [DEBUG] line that mirrors the same stderr"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"# validate template/job before deploy\nnomad job validate job.nomad.hcl\n# validate template rendering locally\nconsul-template -template 'tpl.ctmpl:/tmp/out' -once","typeGuard":null,"tryCatchPattern":"stdout, stderr, code, err := readTemplateFromSandbox(sandboxCfg)\nif err != nil && code != 0 {\n    // stderr carries the consul-template diagnostic — surface it, don't swallow it\n    return nil, fmt.Errorf(\"template render failed: %w: %s\", err, string(stderr))\n}","preventionTips":["Run nomad job validate before submitting jobs with templates","Test templates with the consul-template CLI locally","Ensure consul/vault addresses are reachable from the task sandbox","Read the stderr suffix of the error first — it names the actual template failure"],"tags":["template","consul-template","nomad-client"],"backgroundTag":"template-render-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}