hashicorp/nomad · error

default_pid_mode must be %q or %q, got %q

Error message

default_pid_mode must be %q or %q, got %q

What it means

The exec driver's Config.validate() requires DefaultModePID to be exactly executor.IsolationModePrivate or executor.IsolationModeHost; anything else (empty string, "none", typos) fails. This config check runs when the driver plugin receives its configuration via SetConfig.

Source

Thrown at drivers/exec/driver.go:176

	DefaultModePID string `codec:"default_pid_mode"`

	// DefaultModeIPC is the default IPC isolation set for all tasks using
	// exec-based task drivers.
	DefaultModeIPC string `codec:"default_ipc_mode"`

	// AllowCaps configures which Linux Capabilities are enabled for tasks
	// running on this node.
	AllowCaps []string `codec:"allow_caps"`

	DeniedHostUids string `codec:"denied_host_uids"`
	DeniedHostGids string `codec:"denied_host_gids"`
}

func (c *Config) validate() error {
	switch c.DefaultModePID {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_pid_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModePID)
	}

	switch c.DefaultModeIPC {
	case executor.IsolationModePrivate, executor.IsolationModeHost:
	default:
		return fmt.Errorf("default_ipc_mode must be %q or %q, got %q", executor.IsolationModePrivate, executor.IsolationModeHost, c.DefaultModeIPC)
	}

	badCaps := capabilities.Supported().Difference(capabilities.New(c.AllowCaps))
	if !badCaps.Empty() {
		return fmt.Errorf("allow_caps configured with capabilities not supported by system: %s", badCaps)
	}

	return nil
}

// TaskConfig is the driver configuration of a task within a job
type TaskConfig struct {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set default_pid_mode = "private" (recommended) or "host" in the exec driver plugin config.
2. Fix spelling/case; values are matched exactly against executor.IsolationModePrivate/Host.
3. Remove the key entirely if you only need task-level PID isolation overrides and the driver supports absent defaults.
4. Also verify the companion default_ipc_mode, validated the same way.

Example fix

// before (client HCL)
plugin "exec" {
  config { default_pid_mode = "none" }
}
// after
plugin "exec" {
  config { default_pid_mode = "private" }
}

allowed := map[string]bool{"private": true, "host": true}
if !allowed[strings.ToLower(cfg.DefaultModePID)] {
  return fmt.Errorf("default_pid_mode %q invalid; use private or host", cfg.DefaultModePID)
}

if err := cfg.validate(); err != nil {
  return fmt.Errorf("exec driver config rejected: %w", err)
}

When it happens

Trigger: Setting default_pid_mode in the exec driver plugin config on a Nomad client to any value other than "private" or "host", including omitting it (empty string) when no default is applied.

Common situations: Typo in client HCL ("default_pid_mode = pubilc"), copy-pasted Docker-driver values like "bridge", or upgrading Nomad where the previously-accepted value was removed.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• default_ipc_mode must be %q or %q, got %q
• Reschedule policy has unlimited attempts enabled and a low d
• Lock delay and TTL must be positive
• https_handshake_timeout must be >= 0
• http_max_conns_per_client must be >= 0

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/df9db920b0b14ee6. Report an issue: GitHub.