{"record":{"id":"ffda1f7635ce3714","repo":"hashicorp/nomad","slug":"volumes-are-not-enabled-cannot-mount-host-path","errorCode":null,"errorMessage":"volumes are not enabled; cannot mount host path: %q","messagePattern":"volumes are not enabled; cannot mount host path: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":812,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"invalid docker volume %q: %v\", userbind, err)\n\t\t}\n\n\t\t// Paths inside task dir are always allowed when using the default driver,\n\t\t// Relative paths are always allowed as they mount within a container\n\t\t// When a VolumeDriver is set, we assume we receive a binding in the format\n\t\t// volume-name:container-dest\n\t\t// Otherwise, we assume we receive a relative path binding in the format\n\t\t// relative/to/task:/also/in/container\n\t\tif taskLocalBindVolume {\n\t\t\tsrc = expandPath(task.TaskDir().Dir, src)\n\t\t} else {\n\t\t\t// Resolve dotted path segments\n\t\t\tsrc = filepath.Clean(src)\n\t\t}\n\n\t\tif !d.config.Volumes.Enabled {\n\t\t\tif err := escapingfs.ChildEscapesParentDir(task.AllocDir, src); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"volumes are not enabled; cannot mount host path: %q\", userbind)\n\t\t\t}\n\t\t}\n\n\t\tbind := src + \":\" + dst\n\t\topts := mode\n\t\tif opts != \"\" {\n\t\t\tif selinuxLabel != \"\" {\n\t\t\t\topts += \",\" + selinuxLabel\n\t\t\t}\n\t\t} else {\n\t\t\topts = selinuxLabel\n\t\t}\n\t\tif opts != \"\" {\n\t\t\tbind += \":\" + opts\n\t\t}\n\t\tbinds = append(binds, bind)\n\t}\n","sourceCodeStart":794,"sourceCodeEnd":830,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L794-L830","documentation":"When host volume mounts are disabled (d.config.Volumes.Enabled is false), containerBinds still allows relative/task-dir sources but checks with escapingfs.ChildEscapesParentDir that the source stays inside the allocation directory. This error means the requested bind's source escapes the alloc dir while host-path mounting is forbidden — a security guard against host filesystem access.","triggerScenarios":"config.volumes entry whose cleaned source path resolves outside task.AllocDir (e.g. \"/etc\", \"../../hostpath\", or an absolute host path) while the client has volumes.enabled = false. Raised in createContainerConfig.","commonSituations":"Jobs copied from dev clusters where volumes were enabled; attempts to mount host paths like /var/run/docker.sock without enabling volumes; relative paths with too many '..' segments escaping the alloc dir.","solutions":["Remove the host-path bind from config.volumes, or restrict it to paths within the alloc dir.","Enable volumes on the client if host-path mounts are genuinely required (with operator approval).","Use Nomad host volumes declared in client config and referenced via the volume stanza, which are ACL-controlled.","Fix relative paths that use '..' to escape the allocation directory."],"exampleFix":"// before\nconfig { volumes = [\"/etc/passwd:/tmp/passwd:ro\"] }\n// after\nconfig { volumes = [\"local/data:/data:ro\"] }","handlingStrategy":"validation","validationCode":"func escapesAllocDir(allocDir, src string) bool {\n\tclean := filepath.Clean(src)\n\treturn !strings.HasPrefix(clean, filepath.Clean(allocDir)+string(os.PathSeparator)) && !filepath.IsAbs(clean) == false && strings.HasPrefix(clean, \"..\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use paths inside the alloc dir (local/, alloc/) when volumes are disabled","Never reference absolute host paths in jobs targeting hardened clients","Avoid '..' segments in relative volume sources","Request host volume access via Nomad host volumes, not raw binds"],"tags":["docker","volumes","security","path-escape"],"backgroundTag":"host-path-mount-forbidden","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}