hashicorp/nomad · critical

could not assign executor to Windows job object: %w

Error message

could not assign executor to Windows job object: %w

What it means

This error wraps the failure of windows.AssignProcessToJobObject when the Nomad executor tries to attach its newly created process to a Windows Job Object. Job Objects are how Nomad tracks and cleans up all child processes of a task on Windows. If assignment fails, the executor cannot guarantee process-tree cleanup, so it aborts startup.

Source

Thrown at drivers/shared/executor/executor_windows.go:148

	info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
		BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
			LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
		},
	}
	_, err = windows.SetInformationJobObject(
		job,
		windows.JobObjectExtendedLimitInformation,
		uintptr(unsafe.Pointer(&info)),
		uint32(unsafe.Sizeof(info)))
	if err != nil {
		return fmt.Errorf("could not configure Windows job object for executor: %w", err)
	}

	handle := windows.CurrentProcess()
	err = windows.AssignProcessToJobObject(job, handle)
	if err != nil {
		return fmt.Errorf("could not assign executor to Windows job object: %w", err)
	}

	return nil
}

// Cleanup any still hanging user processes
func (e *UniversalExecutor) killProcessTree(proc *os.Process) error {
	// We must first verify if the process is still running.
	// (Windows process often lingered around after being reported as killed).
	handle, err := syscall.OpenProcess(syscall.PROCESS_TERMINATE|syscall.SYNCHRONIZE|syscall.PROCESS_QUERY_INFORMATION, false, uint32(proc.Pid))
	if err != nil {
		return os.NewSyscallError("OpenProcess", err)
	}
	defer syscall.CloseHandle(handle)

	result, err := syscall.WaitForSingleObject(syscall.Handle(handle), 0)

	switch result {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the Windows version supports nested job objects (Windows 8/Server 2012+); upgrade the host OS
2. Ensure the Nomad agent runs with sufficient privileges (not a heavily restricted service account)
3. Check the preceding 'could not configure Windows job object' path for CreateJobObject failures and fix that first
4. Run Nomad outside restrictive container/sandbox layers that already place the process in an incompatible job

Example fix

// before
if err := windows.AssignProcessToJobObject(job, handle); err != nil { /* startup fails here */ }
// after
// run Nomad agent as a normal service on Windows Server 2016+ so job assignment succeeds

if runtime.GOOS == "windows" && (win32build < win8) { /* upgrade OS before running nomad agent */ }

if err := startTask(); err != nil {
    if strings.Contains(err.Error(), "could not assign executor to Windows job object") {
        // surface host OS / privilege guidance to operator
    }
}

When it happens

Trigger: Calling setNewProcessGroup during executor launch when the OS refuses to assign the current process handle to the job object — e.g. invalid/closed job handle, insufficient privileges, or the process already belongs to a job that disallows reassignment (nested job limitations on older Windows).

Common situations: Running Nomad on constrained Windows environments (containers, older Windows builds without nested job support), running the agent under a security policy that restricts job object usage, or a prior CloseHandle on the job object.

Related errors

• could not create Windows job object for executor: %w
• could not configure Windows job object for executor: %w
• eventlog.level must be one of INFO, WARN, or ERROR
• running container as ContainerAdmin is unsafe; change the co
• QEMU graceful shutdown is unsupported on the Windows platfor

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f395d0ed2e4aa5b8. Report an issue: GitHub.