hashicorp/nomad · error

cap_drop configured with capabilities not supported by syste

Error message

cap_drop configured with capabilities not supported by system: %s

What it means

This error is thrown by the Nomad Java driver during validation when the cap_drop field lists capabilities not supported by the host system. Even though dropping unsupported capabilities would be harmless at runtime, the driver strictly validates the list against capabilities.Supported() and rejects any unknown names. It enforces correct capability spelling and keeps task configs portable.

Source

Thrown at drivers/java/driver.go:219

	default:
		return fmt.Errorf("pid_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModePID)

	}

	switch tc.ModeIPC {
	case "", executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("ipc_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, tc.ModeIPC)
	}

	supported := capabilities.Supported()
	badAdds := supported.Difference(capabilities.New(tc.CapAdd))
	if !badAdds.Empty() {
		return fmt.Errorf("cap_add configured with capabilities not supported by system: %s", badAdds)
	}
	badDrops := supported.Difference(capabilities.New(tc.CapDrop))
	if !badDrops.Empty() {
		return fmt.Errorf("cap_drop configured with capabilities not supported by system: %s", badDrops)
	}

	if tc.WorkDir != "" && !filepath.IsAbs(tc.WorkDir) {
		return fmt.Errorf("work_dir must be an absolute path: %s", tc.WorkDir)
	}
	return nil
}

// TaskState is the state which is encoded in the handle returned in
// StartTask. This information is needed to rebuild the taskConfig state and handler
// during recovery.
type TaskState struct {
	ReattachConfig *pstructs.ReattachConfig
	TaskConfig     *drivers.TaskConfig
	Pid            int
	StartedAt      time.Time
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove or correct the unsupported capability names in cap_drop
2. List only capabilities present in the host's supported set
3. Verify spelling and CAP_ prefix conventions for each entry
4. Schedule the task on hosts that support the listed capabilities

Example fix

// before
-cap_drop = ["CAP_SYS_ADMIN", "CAP_MKNOD", "CAP_SYS_TIMEE"]
// after
-cap_drop = ["CAP_SYS_ADMIN", "CAP_MKNOD"]

import "github.com/hashicorp/nomad/client/lib/capabilities"

func checkCapDrop(drops []string) error {
    bad := capabilities.Supported().Difference(capabilities.New(drops))
    if !bad.Empty() {
        return fmt.Errorf("unsupported cap_drop: %s", bad)
    }
    return nil
}

When it happens

Trigger: A task's Java driver config sets CapDrop with names outside the system's supported capability set; validate() computes supported.Difference(capabilities.New(tc.CapDrop)) and finds a non-empty remainder.

Common situations: Misspelled capability names in cap_drop; copy-pasted configs referencing capabilities from other kernels or runtimes (e.g. Docker-only names); configs written on newer hosts then scheduled on older kernels.

Related errors

• cap_add configured with capabilities not supported by system
• failed driver config validation: %v
• missing secret ID
• namespace cannot contain template delimiters or parenthesis
• wait config is nil or empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/8f2d7c9f3fd8b606. Report an issue: GitHub.