hashicorp/nomad · error

cannot update alloc to Connect in-place

Error message

cannot update alloc to Connect in-place

What it means

The Consul HTTP socket hook (consul_http_sock_hook) manages Connect sidecar proxies for an allocation. On Update, Nomad tries to apply a group service change in place by re-running each existing proxy. If h.proxies is empty there is no proxy process to re-run, so an in-place update to enable Connect is impossible and the hook fails fast with this error.

Source

Thrown at client/allocrunner/consul_http_sock_hook.go:136

	for _, proxy := range h.proxies {
		if err := proxy.run(h.alloc); err != nil {
			mErr = multierror.Append(mErr, err)
		}
	}
	return mErr.ErrorOrNil()
}

func (h *consulHTTPSockHook) Update(req *interfaces.RunnerUpdateRequest) error {
	h.lock.Lock()
	defer h.lock.Unlock()

	h.alloc = req.Alloc

	if !h.shouldRun() {
		return nil
	}
	if len(h.proxies) == 0 {
		return fmt.Errorf("cannot update alloc to Connect in-place")
	}

	var mErr *multierror.Error
	for _, proxy := range h.proxies {
		if err := proxy.run(h.alloc); err != nil {
			mErr = multierror.Append(mErr, err)
		}
	}
	return mErr.ErrorOrNil()
}

func (h *consulHTTPSockHook) Postrun() error {
	h.lock.Lock()
	defer h.lock.Unlock()

	for _, proxy := range h.proxies {
		if err := proxy.stop(); err != nil {
			// Only log failures to stop proxies. Worst case scenario is a small

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Reschedule the allocation (stop the old job / use nomad job stop -purge or change the job so allocs are replaced) instead of in-place update
2. Force a destructive update: add a wildcard to the job's task/group or change a field that prevents in-place update, e.g. update stanza with canary/rolling
3. Restart the allocation with nomad alloc restart or nomad job stop then run the updated job
4. Ensure the group had connect services at initial scheduling so proxies are created in Prestart

Example fix

// before: in-place edit adds Connect to a running alloc
nomad job run app.nomad  // app.nomad now includes connect sidecar_service

// after: stop and resubmit so allocs are replaced
nomad job stop app && nomad job run app.nomad

// before submitting an in-place job update, check whether the change adds Connect to a group that lacked it:
old := previousJob.TaskGroups[i].Services
new := updatedJob.TaskGroups[i].Services
addsConnect := !hasConnect(old) && hasConnect(new)
if addsConnect { planReschedule = true }

func requiresReschedule(old, new *api.TaskGroup) bool {
	return connectServiceCount(old) == 0 && connectServiceCount(new) > 0
}

if err := jobRunErr; err != nil && strings.Contains(err.Error(), "cannot update alloc to Connect in-place") {
	// fallback: stop and resubmit the job so allocs are replaced
	client.Jobs().Deregister(jobID, false, nil)
	_, _, err = client.Jobs().Register(updatedJob, nil)
}

When it happens

Trigger: Updating an allocation's job spec to ADD Consul Connect (service.connect block) to a group that was previously scheduled without Connect, so no proxy was started during Prestart; the Update hook then has no proxies to run.

Common situations: Editing a job in-place (nomad job run on an existing alloc) to add a connect sidecar_service for the first time; enabling Connect via a jobspec change instead of rescheduling.

Related errors

• timed out waiting for socket proxy to exit
• consul address must be set on nomad client
• error creating bootstrap configuration for Connect proxy sid
• Service with provider nomad cannot include Connect blocks
• missing %q

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/026527a7ae10ff75. Report an issue: GitHub.