hashicorp/nomad · error

cannot apply %q configuration

Error message

cannot apply %q configuration

What it means

The docker driver validates namespace-related driver config fields (e.g. allowed privileged/sysctl namespaces) against a whitelist of glob patterns (allowedModes). This error means the requested configuration value did not match any allowed glob, so the driver refuses to apply it.

Source

Thrown at drivers/docker/driver.go:2188

func (d *Driver) validateNamespace(allowedModes []string, field string, desiredNs string) error {
	// return early if allow_privileged is configured or
	// if the desiredNs is empty
	if d.config.AllowPrivileged {
		return nil
	}
	if desiredNs == "" {
		return nil
	}

	for _, v := range allowedModes {
		// return if the desired namespace matches a value in allowedModes
		if glob.Glob(v, desiredNs) {
			return nil
		}
	}

	return fmt.Errorf("cannot apply %q configuration", field)
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change the field's value to one that matches an entry in the driver's allowed list (check the Nomad client 'docker' config / allowed_modes).
2. Ask the cluster operator to add the desired namespace pattern to allowedModes in the agent configuration.
3. Run 'nomad node status -verbose' / inspect the client config to see which modes are permitted before scheduling.

Example fix

// before (job task driver config)
 sysctl { "net.ipv4.ip_unprivileged_port_start" = "80" } // not in allowed list
// after
 sysctl { "net.ipv4.ip_unprivileged_port_start" = "1024" } // allowed by glob whitelist

// Before submitting, check the field against the client's allowed modes
allowed := []string{"bridge", "host"} // mirror allowedModes from agent config
if !slices.Contains(allowed, requestedMode) {
    return fmt.Errorf("mode %q not in allowed list %v", requestedMode, allowed)
}

When it happens

Trigger: A docker driver config field (e.g. a sysctl or namespace mode such as 'ipc', 'pid', 'network' settings) is set to a value that fails every glob.Glob(v, desiredNs) match in allowedModes; validateConfig/driver setup then returns this error naming the offending field.

Common situations: Requesting a namespace mode not on the host's allowed list (e.g. host networking or privileged namespaces restricted by the Nomad agent config); operator tightened allowed_modes in the client config while jobs still request old values; case/format mismatch between requested value and whitelist patterns.

Related errors

• failed to parse config:
• rpc.dial_timeout must be greater than or equal to zero
• client_introduction.enforcement must be set
• client_introduction.default_identity_ttl must be greater one
• client_introduction.max_identity_ttl must be greater one

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e19fb461b595769d. Report an issue: GitHub.