hashicorp/nomad · error

cannot apply allowed_modes configuration, %q is not a valid

Error message

cannot apply allowed_modes configuration, %q is not a valid utc_mode

What it means

The UTS (hostname domain) allowlist entries are validated with containerapi.UTSMode(v).Valid(), which accepts only "" and "host". Any other value in the uts_modes allowlist fails driver setup. Note the message says 'utc_mode' — a typo in the source for UTS mode.

Source

Thrown at drivers/docker/config.go:906

		for _, v := range allowedNS.IPC {
			if !containerapi.IpcMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid ipc_mode", v)
			}
		}
	}

	if len(allowedNS.Userns) > 0 {
		for _, v := range allowedNS.Userns {
			if !containerapi.UsernsMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid userns_mode", v)
			}
		}
	}

	if len(allowedNS.UTS) > 0 {
		for _, v := range allowedNS.UTS {
			if !containerapi.UTSMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid utc_mode", v)
			}
		}
	}
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Only use "host" (or empty string) entries in uts_modes.
2. Ignore the 'utc_mode' wording — this refers to uts_mode validation.
3. Remove any ipc-style values ('private', 'shareable') copied from other allowlists.
4. Validate the config with the agent before deploy.

Example fix

// before
uts_modes = ["private"]
// after
uts_modes = ["host"]

func validUts(v string) bool { return v == "" || v == "host" }
for _, m := range cfg.AllowedModes.UTS {
    if !validUts(m) { return fmt.Errorf("invalid uts_mode %q", m) }
}

Catch the setup error and treat it as a fatal allowlist configuration mistake; note the message typo says 'utc_mode' but means UTS.

When it happens

Trigger: Configuring uts_modes = ["host", "private"] or any non-""/non-"host" value in the docker plugin allowlist.

Common situations: Operators mirror the ipc allowlist and add 'private' or 'shareable', which are invalid for UTS; confusion is worsened by the misleading 'utc_mode' wording in the message.

Related errors

• cannot apply allowed_modes configuration, %q is not a valid
• cannot apply allowed_modes configuration, %q is not a valid
• cannot apply allowed_modes configuration, %q is not a valid
• wait config is nil or empty
• retry config is nil or empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1577cdfc3d2f0642. Report an issue: GitHub.