hashicorp/nomad · error

cannot apply allowed_modes configuration, %q is not a valid

Error message

cannot apply allowed_modes configuration, %q is not a valid ipc_mode

What it means

Same allowlist validation path as pid_mode, but for ipc_mode: each entry in the ipc_modes allowlist is checked with containerapi.IpcMode(v).Valid(). An unrecognized value fails plugin setup with this error.

Source

Thrown at drivers/docker/config.go:890

	driverCapabilities.DisableLogCollection = d.config != nil && d.config.DisableLogCollection
	return driverCapabilities, nil
}

func validateAllowedNamespace(allowedNS AllowedModesConfig) error {
	// check user supplied allowlist values against containerapi type validator
	// https://github.com/moby/moby/blob/master/api/types/container/hostconfig.go

	if len(allowedNS.PID) > 0 {
		for _, v := range allowedNS.PID {
			if !containerapi.PidMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid pid_mode", v)
			}
		}
	}
	if len(allowedNS.IPC) > 0 {
		for _, v := range allowedNS.IPC {
			if !containerapi.IpcMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid ipc_mode", v)
			}
		}
	}

	if len(allowedNS.Userns) > 0 {
		for _, v := range allowedNS.Userns {
			if !containerapi.UsernsMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid userns_mode", v)
			}
		}
	}

	if len(allowedNS.UTS) > 0 {
		for _, v := range allowedNS.UTS {
			if !containerapi.UTSMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid utc_mode", v)
			}
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Use only valid ipc_mode values: "", "private", "host", "shareable", or "container:<name|id>".
2. Replace 'shared'/'share' with the correct 'shareable'.
3. Verify against your Docker daemon version's container.HostConfig.IpcMode.Valid() semantics.
4. Remove invalid entries until the allowlist validates, then re-test jobs.

Example fix

// before
ipc_modes = ["shared"]
// after
ipc_modes = ["shareable", "host"]

var validIpcModes = map[string]bool{"": true, "host": true, "private": true, "shareable": true}
validIpc := func(v string) bool {
    return validIpcModes[v] || strings.HasPrefix(v, "container:")
}

Catch the setup error and fail config validation early, naming the invalid ipc_modes entry.

When it happens

Trigger: Configuring ipc_modes allowlist with values outside "", "host", "private", "shareable", "container:<name|id>" (and daemon-supported variants).

Common situations: Operators write 'shared' instead of 'shareable', or 'none', or misspell 'container:' prefixed modes; also happens when copying Docker CLI examples from a different Docker release.

Related errors

• cannot apply allowed_modes configuration, %q is not a valid
• cannot apply allowed_modes configuration, %q is not a valid
• cannot apply allowed_modes configuration, %q is not a valid
• wait config is nil or empty
• retry config is nil or empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/8a34f6f390134e26. Report an issue: GitHub.