{"record":{"id":"f8c2021b35765533","repo":"hashicorp/nomad","slug":"oom-score-adj-must-not-be-negative","errorCode":null,"errorMessage":"oom_score_adj must not be negative","messagePattern":"oom_score_adj must not be negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/rawexec/driver.go","lineNumber":198,"sourceCode":"\t// OOMScoreAdj sets the oom_score_adj on Linux systems\n\tOOMScoreAdj int `codec:\"oom_score_adj\"`\n\n\t// WorkDir sets the working directory of the task\n\tWorkDir string `codec:\"work_dir\"`\n\n\t//DeniedEnvvars enables the removal of specified environment variables from a given job environment\n\tDeniedEnvvars []string `codec:\"denied_envvars\"`\n}\n\nfunc (t *TaskConfig) validate() error {\n\t// ensure only one of cgroups_v1_override and cgroups_v2_override have been\n\t// configured; must check here because task config validation cannot happen\n\t// on the server.\n\tif len(t.OverrideCgroupV1) > 0 && t.OverrideCgroupV2 != \"\" {\n\t\treturn errors.New(\"only one of cgroups_v1_override and cgroups_v2_override may be set\")\n\t}\n\tif t.OOMScoreAdj < 0 {\n\t\treturn errors.New(\"oom_score_adj must not be negative\")\n\t}\n\tif t.WorkDir != \"\" && !filepath.IsAbs(t.WorkDir) {\n\t\treturn errors.New(\"work_dir must be an absolute path\")\n\t}\n\treturn nil\n}\n\n// TaskState is the state which is encoded in the handle returned in\n// StartTask. This information is needed to rebuild the task state and handler\n// during recovery.\ntype TaskState struct {\n\tReattachConfig *pstructs.ReattachConfig\n\tTaskConfig     *drivers.TaskConfig\n\tPid            int\n\tStartedAt      time.Time\n}\n\n// NewRawExecDriver returns a new DriverPlugin implementation","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/rawexec/driver.go#L180-L216","documentation":"rawexec's TaskConfig.validate() rejects a negative oom_score_adj. The value maps directly to the Linux kernel's /proc/<pid>/oom_score_adj, which must be within [-1000, 1000]; Nomad's driver enforces non-negative values to prevent tasks from being made immune to the OOM killer.","triggerScenarios":"Submitting a rawexec task with oom_score_adj set to a negative integer in the driver config; validate() runs at task-config parse time on the client.","commonSituations":"Operators trying to protect critical processes from the OOM killer copy Linux admin advice that uses negative values; typo like \"oom_score_adj = -100\" from an older systemd unit config; misunderstanding of Nomad's intentionally stricter validation.","solutions":["Set oom_score_adj to 0 or a positive value (e.g. 100–1000) as required by the driver","Remove oom_score_adj entirely to inherit the default score","If the process truly must be OOM-protected, run it outside Nomad or adjust at the system level with the appropriate privileges","Review Nomad docs for the allowed oom_score_adj range in your version"],"exampleFix":"// before\nconfig {\n  command = \"/bin/app\"\n  oom_score_adj = -500\n}\n// after\nconfig {\n  command = \"/bin/app\"\n  oom_score_adj = 500\n}","handlingStrategy":"validation","validationCode":"func checkOomScoreAdj(v *int) error {\n    if v != nil && *v < 0 {\n        return errors.New(\"oom_score_adj must be >= 0\")\n    }\n    return nil\n}","typeGuard":"func validOomScore(v int) bool { return v >= 0 }","tryCatchPattern":null,"preventionTips":["Remember Nomad only accepts non-negative oom_score_adj","Do not copy Linux/sysadmin negative values into rawexec configs","Review rawexec task schema when upgrading Nomad versions"],"tags":["rawexec","oom","config-validation","linux"],"backgroundTag":"config-value-out-of-range","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}