hashicorp/nomad · error

allow_caps configured with capabilities not supported by sys

Error message

allow_caps configured with capabilities not supported by system: %s

What it means

After validating pid/ipc modes, Config.validate() diffs the configured allow_caps list against the capability set the system actually supports (capabilities.Supported()). If any configured capability is unsupported on this host, the driver setup fails with this error listing the bad capabilities.

Source

Thrown at drivers/java/driver.go:157

	AllowCaps []string `codec:"allow_caps"`
}

func (c *Config) validate() error {
	switch c.DefaultModePID {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_pid_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)
	}

	switch c.DefaultModeIPC {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_ipc_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)
	}

	badCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))
	if !badCaps.Empty() {
		return fmt.Errorf("allow_caps configured with capabilities not supported by system: %s", badCaps)
	}

	return nil
}

// TaskConfig is the driver configuration of a taskConfig within a job
type TaskConfig struct {
	// Class indicates which class contains the java entry point.
	Class string `codec:"class"`

	// ClassPath indicates where class files are found.
	ClassPath string `codec:"class_path"`

	// JarPath indicates where a jar  file is found.
	JarPath string `codec:"jar_path"`

	// JvmOpts are arguments to pass to the JVM
	JvmOpts []string `codec:"jvm_options"`

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove or correct the unsupported capabilities listed in the error message.
2. Run `capsh --print` or check the kernel to see which capabilities the host supports.
3. If the capability is genuinely needed, upgrade the host kernel or run Nomad outside the restricting container.
4. Use `nomad agent validate` or the `nomad plugin status` output to confirm the allowed set.

Example fix

// before
plugin "java" {
  allow_caps = ["net_admin", "sys_time", "bogus_cap"]
}
// after
plugin "java" {
  allow_caps = ["net_admin", "sys_time"]
}

supported := map[string]bool{"chown": true, "dac_override": true, "fowner": true /* ...discover via capabilities.Supported() */}
for _, c := range allowCaps {
    if !supported[c] {
        return fmt.Errorf("capability %q not supported on this host", c)
    }
}

if err := driver.SetConfig(cfg); err != nil && strings.Contains(err.Error(), "allow_caps") {
    return fmt.Errorf("remove unsupported capabilities from allow_caps: %w", err)
}

When it happens

Trigger: allow_caps in the java driver plugin config contains Linux capabilities not present in the host kernel's supported set.

Common situations: Config copied from a newer kernel host to an older one; typos in capability names (e.g. "SYS_ADMINX"); running Nomad inside a container with a reduced capability bounding set.

Related errors

• failed driver config validation: %v
• default_pid_mode must be %q or %q, got %q
• default_ipc_mode must be %q or %q, got %q
• pid_mode must be %q or %q, got %q
• ipc_mode must be %q or %q, got %q

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/48359d01ea3a7b94. Report an issue: GitHub.