hashicorp/nomad · error

disable_artifact_inspection must be set

Error message

disable_artifact_inspection must be set

What it means

ArtifactConfig.Validate() requires disable_artifact_inspection to be explicitly set (non-nil bool pointer). Nomad inspects downloaded artifacts for security; the config must state whether inspection is disabled, so nil fails with 'disable_artifact_inspection must be set'.

Source

Thrown at nomad/structs/config/artifact.go:237

	if a.DecompressionFileCountLimit == nil {
		return fmt.Errorf("decompression_file_count_limit must not be nil")
	}
	if v := *a.DecompressionFileCountLimit; v < 0 {
		return fmt.Errorf("decompression_file_count_limit must be >= 0 but found %d", v)
	}

	if a.DecompressionSizeLimit == nil {
		return fmt.Errorf("decompression_size_limit must not be nil")
	}
	if v, err := humanize.ParseBytes(*a.DecompressionSizeLimit); err != nil {
		return fmt.Errorf("decompression_size_limit is not a valid size: %w", err)
	} else if v > math.MaxInt64 {
		return fmt.Errorf("decompression_size_limit must be < %d but found %d", int64(math.MaxInt64), v)
	}

	if a.DisableArtifactInspection == nil {
		return fmt.Errorf("disable_artifact_inspection must be set")
	}

	if a.DisableFilesystemIsolation == nil {
		return fmt.Errorf("disable_filesystem_isolation must be set")
	}

	for _, p := range a.FilesystemIsolationExtraPaths {
		if _, err := landlock.ParsePath(p); err != nil {
			return fmt.Errorf("filesystem_isolation_extra_paths contains invalid lockdown path %q", p)
		}
	}

	if a.SetEnvironmentVariables == nil {
		return fmt.Errorf("set_environment_variables must be set")
	}

	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add disable_artifact_inspection = false (recommended) or true to the artifact block.
2. Construct configs via DefaultArtifactConfig() so the pointer is initialized before overriding.
3. Fix merge/render pipelines so boolean defaults are never dropped as 'empty'.

Example fix

// before
artifact {
  # disable_artifact_inspection missing
}
// after
artifact {
  disable_artifact_inspection = false
}

if cfg.DisableArtifactInspection == nil {
    return errors.New("artifact config must set disable_artifact_inspection (use false to keep inspection on)")
}

func hasInspectionFlag(a *ArtifactConfig) bool { return a.DisableArtifactInspection != nil }

When it happens

Trigger: Calling ArtifactConfig.Validate() where a.DisableArtifactInspection is nil because the disable_artifact_inspection key is absent from the artifact config block.

Common situations: Legacy artifact configs from before inspection existed; manually constructed ArtifactConfig in tests or plugins; config merge/render steps that omit false-valued keys; users copying partial example configs.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• s3_timeout must be set
• decompression_file_count_limit must not be nil
• decompression_size_limit must not be nil
• job is missing ID
• LockNoPathErr

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1f7f373f46820163. Report an issue: GitHub.