{"record":{"id":"f20bd01a81437086","repo":"hashicorp/nomad","slug":"filesystem-function-disabled","errorCode":null,"errorMessage":"filesystem function disabled","messagePattern":"filesystem function disabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"jobspec2/functions.go","lineNumber":133,"sourceCode":"\n\tif !fips140.Enabled() {\n\t\tfuncs[\"md5\"] = crypto.Md5Func\n\t\tfuncs[\"sha1\"] = crypto.Sha1Func\n\t}\n\n\treturn funcs\n}\n\nfunc guardFS(allowFS bool, fn function.Function) function.Function {\n\tif allowFS {\n\t\treturn fn\n\t}\n\n\tspec := &function.Spec{\n\t\tParams:   fn.Params(),\n\t\tVarParam: fn.VarParam(),\n\t\tType: func([]cty.Value) (cty.Type, error) {\n\t\t\treturn cty.DynamicPseudoType, fmt.Errorf(\"filesystem function disabled\")\n\t\t},\n\t\tImpl: func([]cty.Value, cty.Type) (cty.Value, error) {\n\t\t\treturn cty.DynamicVal, fmt.Errorf(\"filesystem functions disabled\")\n\t\t},\n\t}\n\n\treturn function.New(spec)\n}\n","sourceCodeStart":115,"sourceCodeEnd":142,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/jobspec2/functions.go#L115-L142","documentation":"jobspec2 deliberately disables filesystem-related HCL functions (e.g. file(), templatefile()). The function spec's Type and Impl both return this error, so any use of a filesystem function during type/eval fails with 'filesystem function disabled'.","triggerScenarios":"Evaluating a jobspec whose HCL invokes a filesystem function (file, fileexists, etc.) when functions.go builds the function set with the FS-disabled option; the error surfaces during type checking of the call.","commonSituations":"Job specs written for tools that allow filesystem functions (like Terraform) being reused in Nomad jobspecs; attempting to read local files at job-parse time, which is intentionally disallowed for safety/determinism.","solutions":["Remove the filesystem function from the jobspec and inline the file's contents literally.","Pass the needed data via var declarations (-var / var-file) instead of reading files in HCL.","Use template/user variables or the scheduler's supported mechanisms (e.g. artifact blocks, template stanzas) to bring file content in at runtime.","If you truly need FS functions, use a parse API variant that enables them, if available."],"exampleFix":"// before\nvalue = file(\"config.txt\")\n\n// after\nvariable \"config\" { type = string }\nvalue = var.config // pass with -var config=$(cat config.txt)","handlingStrategy":"validation","validationCode":"// Scan the jobspec source for disabled FS functions before parsing\nre := regexp.MustCompile(`\\b(file|fileexists|abspath|basename|dirname)\\s*\\(`)\nif re.MatchString(spec) {\n    return errors.New(\"jobspec uses disabled filesystem functions; inline content or use vars\")\n}","typeGuard":null,"tryCatchPattern":"if err := ParseWithConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"filesystem function\") {\n        // rewrite spec / instruct user to inline the value\n    }\n}","preventionTips":["Lint job specs for file() and related functions in CI.","Standardize on vars/artifact/template for external content.","Do not copy Terraform HCL with filesystem functions unmodified."],"tags":["hcl","jobspec","filesystem","functions"],"backgroundTag":"function-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}