hashicorp/nomad · error

default_pid_mode must be %q or %q, got %q

Error message

default_pid_mode must be %q or %q, got %q

What it means

The Java driver's plugin-level Config.validate() checks that default_pid_mode (the default PID namespace mode for tasks) is either "private" or "host" as defined by executor.IsolationModePrivate/Host. Any other value in the driver plugin configuration is rejected at driver setup time.

Source

Thrown at drivers/java/driver.go:146

type Config struct {
	// DefaultModePID is the default PID isolation set for all tasks using
	// exec-based task drivers.
	DefaultModePID string `codec:"default_pid_mode"`

	// DefaultModeIPC is the default IPC isolation set for all tasks using
	// exec-based task drivers.
	DefaultModeIPC string `codec:"default_ipc_mode"`

	// AllowCaps configures which Linux Capabilities are enabled for tasks
	// running on this node.
	AllowCaps []string `codec:"allow_caps"`
}

func (c *Config) validate() error {
	switch c.DefaultModePID {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_pid_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)
	}

	switch c.DefaultModeIPC {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_ipc_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)
	}

	badCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))
	if !badCaps.Empty() {
		return fmt.Errorf("allow_caps configured with capabilities not supported by system: %s", badCaps)
	}

	return nil
}

// TaskConfig is the driver configuration of a taskConfig within a job
type TaskConfig struct {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set default_pid_mode to exactly "private" or "host" in the driver plugin config.
2. Check quoting/case sensitivity in the HCL/JSON agent configuration.
3. Consult the Java driver docs for the current list of accepted isolation modes.

Example fix

// before
plugin "java" {
  default_pid_mode = "container"
}
// after
plugin "java" {
  default_pid_mode = "private"
}

mode := cfg["default_pid_mode"]
if mode != "" && mode != "private" && mode != "host" {
    return fmt.Errorf("default_pid_mode must be 'private' or 'host', got %q", mode)
}

if err := driver.SetConfig(cfg); err != nil && strings.Contains(err.Error(), "default_pid_mode") {
    return fmt.Errorf("fix default_pid_mode in driver plugin config: %w", err)
}

When it happens

Trigger: Driver plugin configuration containing default_pid_mode set to a value other than "private" or "host" (typo, wrong casing, empty string).

Common situations: Operator typos in agent config (e.g. default_pid_mode = "container", "shared", or "Private"); copying config from docker driver docs; upgrades where allowed values changed.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• default_ipc_mode must be %q or %q, got %q
• allow_caps configured with capabilities not supported by sys
• pid_mode must be %q or %q, got %q
• ipc_mode must be %q or %q, got %q
• jar_path or class must be specified

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/03f487a2ba3fb704. Report an issue: GitHub.