hashicorp/nomad · error

default_ipc_mode must be %q or %q, got %q

Error message

default_ipc_mode must be %q or %q, got %q

What it means

The exec driver's Validate() rejects plugin-level configurations whose DefaultModeIPC is not exactly "private" or "host". These are the only IPC isolation modes the underlying executor supports (they map to executor.IsolationModePrivate/IsolationModeHost). Any other value means Nomad would not know how to set up the task's IPC namespace, so validation fails before any task runs.

Source

Thrown at drivers/exec/driver.go:182

	// AllowCaps configures which Linux Capabilities are enabled for tasks
	// running on this node.
	AllowCaps []string `codec:"allow_caps"`

	DeniedHostUids string `codec:"denied_host_uids"`
	DeniedHostGids string `codec:"denied_host_gids"`
}

func (c *Config) validate() error {
	switch c.DefaultModePID {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_pid_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)
	}

	switch c.DefaultModeIPC {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_ipc_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)
	}

	badCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))
	if !badCaps.Empty() {
		return fmt.Errorf("allow_caps configured with capabilities not supported by system: %s", badCaps)
	}

	return nil
}

// TaskConfig is the driver configuration of a task within a job
type TaskConfig struct {
	// Command is the thing to exec.
	Command string `codec:"command"`

	// Args are passed along to Command.
	Args []string `codec:"args"`

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set default_ipc_mode to exactly "private" or "host" in the plugin config, or remove the option to use the default
2. Fix casing/typos (values are lowercase)
3. Remove Docker-only IPC modes (none, container:...) which exec does not support

Example fix

// before
plugin "exec" {
  config {
    default_ipc_mode = "none"
  }
}
// after
plugin "exec" {
  config {
    default_ipc_mode = "private"
  }

valid := []string{"private", "host"}
for _, m := range valid {
  if cfg.DefaultModeIPC == m {
    return true
  }
}
return false

func isValidIPCMode(v string) bool {
  return v == "private" || v == "host"
}

if err := driver.SetConfig(cfg); err != nil {
  if strings.Contains(err.Error(), "default_ipc_mode") {
    cfg.DefaultModeIPC = "private"
    err = driver.SetConfig(cfg)
  }
  return err
}

When it happens

Trigger: SetConfig -> validate() runs when the exec driver plugin config is loaded; it fires whenever driverConfig.DefaultModeIPC is set to a string other than "private" or "host" (typo, wrong case like "Private", or a Docker-style value like "none" or "container:<id>").

Common situations: Operators copying Docker IPC options (none, container:xxx) into the Nomad exec driver block; typos in client HCL config; host agent config templates with misspelled keys; upgrading from other runtimes with different isolation vocabularies.

Related errors

• default_pid_mode must be %q or %q, got %q
• Reschedule policy has unlimited attempts enabled and a low d
• Lock delay and TTL must be positive
• https_handshake_timeout must be >= 0
• http_max_conns_per_client must be >= 0

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/d1fbf42b7b487c68. Report an issue: GitHub.