hashicorp/nomad · error

cannot apply allowed_modes configuration, %q is not a valid

Error message

cannot apply allowed_modes configuration, %q is not a valid pid_mode

What it means

When validating the docker driver's allowed_modes allowlist, each configured pid_mode value is checked with containerapi.PidMode(v).Valid(). An invalid entry rejects the whole allowlist at plugin setup, because applying it would let jobs request a pid_mode the Docker API would reject or that is semantically wrong.

Source

Thrown at drivers/docker/config.go:883

func (d *Driver) TaskConfigSchema() (*hclspec.Spec, error) {
	return taskConfigSpec, nil
}

// Capabilities is returned by the Capabilities RPC and indicates what optional
// features this driver supports.
func (d *Driver) Capabilities() (*drivers.Capabilities, error) {
	driverCapabilities.DisableLogCollection = d.config != nil && d.config.DisableLogCollection
	return driverCapabilities, nil
}

func validateAllowedNamespace(allowedNS AllowedModesConfig) error {
	// check user supplied allowlist values against containerapi type validator
	// https://github.com/moby/moby/blob/master/api/types/container/hostconfig.go

	if len(allowedNS.PID) > 0 {
		for _, v := range allowedNS.PID {
			if !containerapi.PidMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid pid_mode", v)
			}
		}
	}
	if len(allowedNS.IPC) > 0 {
		for _, v := range allowedNS.IPC {
			if !containerapi.IpcMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid ipc_mode", v)
			}
		}
	}

	if len(allowedNS.Userns) > 0 {
		for _, v := range allowedNS.Userns {
			if !containerapi.UsernsMode(v).Valid() {
				return fmt.Errorf("cannot apply allowed_modes configuration, %q is not a valid userns_mode", v)
			}
		}
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Correct the allowlist entry to a valid pid_mode value: "", "host", or "container:<name|id>".
2. Check case-sensitivity — values are matched exactly by Docker's PidMode.Valid(), so use lowercase 'host'.
3. Remove the offending entry from pid_modes if it was experimental/removed in your Docker version.
4. Test validity locally with 'docker run --pid <value> ...' against the same daemon version.

Example fix

// before
plugin "docker" {
  config {
    allowlist {
      pid_modes = ["Host", "container:sidecar"]
    }
  }
}
// after
plugin "docker" {
  config {
    allowlist {
      pid_modes = ["host", "container:sidecar"]
    }
  }
}

// Pre-validate allowlist entries before writing config
var validPidModes = map[string]bool{"": true, "host": true}
validPid := func(v string) bool {
    return validPidModes[v] || strings.HasPrefix(v, "container:")
}
for _, m := range cfg.AllowedModes.PID {
    if !validPid(m) { return fmt.Errorf("invalid pid_mode %q", m) }
}

Treat driver setup error as fatal config error: catch, surface the offending allowlist entry, and stop the deploy.

When it happens

Trigger: Setting allowlist entry pid_modes = ["host", "bogus"] (or any value not in "", "host", "container:<name>") in the docker plugin config; validation runs during driver SetupClient.

Common situations: Operators typo 'host' as 'Host' or 'hostr', or attempt container-scoped pid modes like 'container:foo' with wrong syntax, or copy values from older Docker docs that no longer validate.

Related errors

• cannot apply allowed_modes configuration, %q is not a valid
• cannot apply allowed_modes configuration, %q is not a valid
• cannot apply allowed_modes configuration, %q is not a valid
• wait config is nil or empty
• retry config is nil or empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/723894591526dcdd. Report an issue: GitHub.