elastic/elasticsearch · error · UnsupportedOperationException

AssignProcessToJobObject: {}

Error message

AssignProcessToJobObject: {}

What it means

Thrown as UnsupportedOperationException when kernel32.AssignProcessToJobObject() returns false. This is the final step of exec sandbox installation: assigning the current process to the job with ActiveProcessLimit=1. The failure includes GetLastError(). The most common cause is ERROR_ACCESS_DENIED when the process is already in another job that does not allow breakaway or nested assignment.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java:177

            throw new UnsupportedOperationException("CreateJobObject: " + kernel.GetLastError());
        }

        try {
            // retrieve the current basic limits of the job
            int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;
            var info = kernel.newJobObjectBasicLimitInformation();
            if (kernel.QueryInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("QueryInformationJobObject: " + kernel.GetLastError());
            }
            // modify the number of active processes to be 1 (exactly the one process we will add to the job).
            info.setActiveProcessLimit(1);
            info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);
            if (kernel.SetInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("SetInformationJobObject: " + kernel.GetLastError());
            }
            // assign ourselves to the job
            if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {
                throw new UnsupportedOperationException("AssignProcessToJobObject: " + kernel.GetLastError());
            }
        } finally {
            kernel.CloseHandle(job);
        }

        execSandboxState = ExecSandboxState.ALL_THREADS;
        logger.debug("Windows ActiveProcessLimit initialization successful");
    }

    @Override
    public OptionalLong allocatedSizeInBytes(Path path) {
        assert Files.isRegularFile(path) : path;
        String fileName = "\\\\?\\" + path;
        AtomicInteger lpFileSizeHigh = new AtomicInteger();

        final int lpFileSizeLow = kernel.GetCompressedFileSizeW(fileName, lpFileSizeHigh::set);
        if (lpFileSizeLow == INVALID_FILE_SIZE) {
            logger.warn("Unable to get allocated size of file [{}]. Error code {}", path, kernel.GetLastError());

View on GitHub (pinned to db6a809a66)

Solutions

1. Decode GetLastError() (commonly 5 = ERROR_ACCESS_DENIED for nested job restriction).
2. If running in a container, this is expected; the exec sandbox cannot nest. Catch and continue.
3. If not in a container, check if a parent process (service host, launcher) placed the process in a job.
4. On Windows 8+, nested jobs are supported if the parent allows it; verify the parent job's limits.

Example fix

// before
windowsNativeAccess.tryInstallExecSandbox();

// after
try {
    windowsNativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // common in containers and nested job environments
    logger.warn("Could not assign process to Windows job object; exec sandbox not installed", e);
}

// Detect likely nested-job environments before attempting assignment.
boolean likelyInJob = Boolean.getBoolean("es.container")
    || System.getenv("KUBERNETES_SERVICE_HOST") != null;
if (likelyInJob) {
    logger.info("Running in a container; skipping Windows exec sandbox");
    return;
}

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("AssignProcessToJobObject failed (common in containers); exec sandbox not installed", e);
}

When it happens

Trigger: Calling tryInstallExecSandbox() when the Elasticsearch process is already a member of a job object that prohibits assignment to a nested job. This is extremely common in containers (Docker on Windows), terminal services, and processes launched by service managers that use job objects.

Common situations: Running inside a Windows container (Docker, Hyper-V isolated pods). Process launched by a parent that placed it in a job without JOB_OBJECT_LIMIT_BREAKAWAY_OK. Running under Windows Terminal Services (session-based). SQL Server Agent or similar service hosts that use job objects. WSL2 processes.

Related errors

• CreateJobObject: {}
• QueryInformationJobObject: {}
• SetInformationJobObject: {}
• sandbox_init(): {}
• seccomp unavailable: '{}' architecture unsupported

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/101987f35f710e2e. Report an issue: GitHub.