What causes "cannot apply %q configuration" in hashicorp/nomad?

Change the field's value to one that matches an entry in the driver's allowed list (check the Nomad client 'docker' config / allowed_modes).

hashicorp/nomad · error

cannot apply configuration

Error message

cannot apply %q configuration

What it means

The docker driver validates namespace-related driver config fields (e.g. allowed privileged/sysctl namespaces) against a whitelist of glob patterns (allowedModes). This error means the requested configuration value did not match any allowed glob, so the driver refuses to apply it.

Solutions

Change the field's value to one that matches an entry in the driver's allowed list (check the Nomad client 'docker' config / allowed_modes).
Ask the cluster operator to add the desired namespace pattern to allowedModes in the agent configuration.
Run 'nomad node status -verbose' / inspect the client config to see which modes are permitted before scheduling.

Example fix

// before (job task driver config)
 sysctl { "net.ipv4.ip_unprivileged_port_start" = "80" } // not in allowed list
// after
 sysctl { "net.ipv4.ip_unprivileged_port_start" = "1024" } // allowed by glob whitelist

Defensive patterns

Strategy: validation

Validate before calling

// Before submitting, check the field against the client's allowed modes
allowed := []string{"bridge", "host"} // mirror allowedModes from agent config
if !slices.Contains(allowed, requestedMode) {
    return fmt.Errorf("mode %q not in allowed list %v", requestedMode, allowed)
}

Prevention

Keep job driver configs in sync with the Nomad client's allowed lists.
Test job specs against a staging client with the same agent config.
Coordinate with operators before relying on privileged namespace settings.

When it happens

Trigger: A docker driver config field (e.g. a sysctl or namespace mode such as 'ipc', 'pid', 'network' settings) is set to a value that fails every glob.Glob(v, desiredNs) match in allowedModes; validateConfig/driver setup then returns this error naming the offending field.

Common situations: Requesting a namespace mode not on the host's allowed list (e.g. host networking or privileged namespaces restricted by the Nomad agent config); operator tightened allowed_modes in the client config while jobs still request old values; case/format mismatch between requested value and whitelist patterns.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e19fb461b595769d. Report an issue: GitHub.

Appendix: source

Thrown at drivers/docker/driver.go:2188

func (d *Driver) validateNamespace(allowedModes []string, field string, desiredNs string) error {
	// return early if allow_privileged is configured or
	// if the desiredNs is empty
	if d.config.AllowPrivileged {
		return nil
	}
	if desiredNs == "" {
		return nil
	}

	for _, v := range allowedModes {
		// return if the desired namespace matches a value in allowedModes
		if glob.Glob(v, desiredNs) {
			return nil
		}
	}

	return fmt.Errorf("cannot apply %q configuration", field)
}

View on GitHub (pinned to 482b49bf1a)