allow_caps configured with capabilities not supported by sys

Error message

allow_caps configured with capabilities not supported by system: %s

What it means

During plugin config validation the driver computes capabilities.Supported().Difference(capabilities.New(c.AllowCaps)); if any capability in allow_caps is not supported by the host kernel, validation fails. This prevents advertising driver-level capabilities the system cannot grant.

Source

Thrown at drivers/exec/driver.go:187

	DeniedHostGids string `codec:"denied_host_gids"`
}

func (c *Config) validate() error {
	switch c.DefaultModePID {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_pid_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)
	}

	switch c.DefaultModeIPC {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_ipc_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)
	}

	badCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))
	if !badCaps.Empty() {
		return fmt.Errorf("allow_caps configured with capabilities not supported by system: %s", badCaps)
	}

	return nil
}

// TaskConfig is the driver configuration of a task within a job
type TaskConfig struct {
	// Command is the thing to exec.
	Command string `codec:"command"`

	// Args are passed along to Command.
	Args []string `codec:"args"`

	// ModePID indicates whether PID namespace isolation is enabled for the task.
	// Must be "private" or "host" if set.
	ModePID string `codec:"pid_mode"`

	// ModeIPC indicates whether IPC namespace isolation is enabled for the task.

View on GitHub (pinned to 482b49bf1a)

Solutions

Run with only host-supported capabilities; check the error message for the offending list and remove/fix those entries
Verify supported caps with `capsh --print` or by inspecting capabilities.Supported()
Fix capability name spelling/prefixing

Example fix

// before
config {
  allow_caps = ["CAP_SYS_ADMIN", "CAP_NET_ADMIN"]
}
// after
config {
  allow_caps = ["CAP_NET_ADMIN"]
}

Defensive patterns

Strategy: validation

Validate before calling

supported := map[string]bool{ "CAP_CHOWN":true, "CAP_DAC_OVERRIDE":true, /* fill from capabilities.Supported() on target host */ }
for _, c := range cfg.AllowCaps {
  if !supported[c] {
    return fmt.Errorf("unsupported cap: %s", c)
  }
}

Type guard

func allCapsSupported(caps []string, supported func() capabilities.Set) bool {
  return supported().Difference(capabilities.New(caps)).Empty()
}

Try / catch

if err := driver.SetConfig(cfg); err != nil {
  if strings.Contains(err.Error(), "allow_caps") {
    log.Printf("fix allow_caps: %v", err)
  }
  return err
}

Prevention

Check host capability support (capsh --print) before advertising allow_caps
Use the default allow_caps unless you specifically need more
Keep capability lists short and reviewed to avoid typos

When it happens

Trigger: SetConfig -> validate() when driverConfig.AllowCaps contains a capability string not in the host's supported set (e.g. CAP_SYS_ADMIN unsupported or misspelled like "NET_ADMIN " with whitespace or missing CAP_ prefix mismatch).

Common situations: Older kernels lacking newer capabilities; typos in capability names; copying Docker capability lists that include names the host doesn't support; running inside containers/VMs with restricted capability sets.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/aca7bc9a4684078f. Report an issue: GitHub.