hashicorp/nomad · error

disable_filesystem_isolation must be set

Error message

disable_filesystem_isolation must be set

What it means

ArtifactConfig.Validate requires every nullable boolean knob to be explicitly set so that agent configs always state their intent. If DisableArtifactInspection is a nil *bool, validation fails with this message. Nomad deliberately forces explicit true/false rather than guessing a default.

Source

Thrown at nomad/structs/config/artifact.go:241

	if v := *a.DecompressionFileCountLimit; v < 0 {
		return fmt.Errorf("decompression_file_count_limit must be >= 0 but found %d", v)
	}

	if a.DecompressionSizeLimit == nil {
		return fmt.Errorf("decompression_size_limit must not be nil")
	}
	if v, err := humanize.ParseBytes(*a.DecompressionSizeLimit); err != nil {
		return fmt.Errorf("decompression_size_limit is not a valid size: %w", err)
	} else if v > math.MaxInt64 {
		return fmt.Errorf("decompression_size_limit must be < %d but found %d", int64(math.MaxInt64), v)
	}

	if a.DisableArtifactInspection == nil {
		return fmt.Errorf("disable_artifact_inspection must be set")
	}

	if a.DisableFilesystemIsolation == nil {
		return fmt.Errorf("disable_filesystem_isolation must be set")
	}

	for _, p := range a.FilesystemIsolationExtraPaths {
		if _, err := landlock.ParsePath(p); err != nil {
			return fmt.Errorf("filesystem_isolation_extra_paths contains invalid lockdown path %q", p)
		}
	}

	if a.SetEnvironmentVariables == nil {
		return fmt.Errorf("set_environment_variables must be set")
	}

	return nil
}

func DefaultArtifactConfig() *ArtifactConfig {
	return &ArtifactConfig{
		// Read timeout for HTTP operations. Must be long enough to

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add disable_artifact_inspection = true/false to the artifact block in your agent config
2. If constructing in Go, set DisableArtifactInspection: pointerOf(bool) to an explicit value before calling Validate
3. Start from DefaultArtifactConfig() and override only what you need

Example fix

// before
artifact {
  disable_filesystem_isolation = false
}
// after
artifact {
  disable_artifact_inspection = false
  disable_filesystem_isolation = false
}

if cfg.Artifact != nil && cfg.Artifact.DisableArtifactInspection == nil {
    return errors.New("artifact block must set disable_artifact_inspection explicitly")
}

When it happens

Trigger: Calling Validate() on an ArtifactConfig built from a partial config (e.g. JSON/HCL that omitted the disable_artifact_inspection key) leaves the pointer nil and triggers the error.

Common situations: Hand-written agent config files missing the field; upgrading Nomad after new required artifact fields were added; programmatically constructing ArtifactConfig{} without initializing all pointer fields.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• rcp.accept_backlog interval must be greater than zero
• rcp.keep_alive_interval must be greater than zero
• rcp.connection_write_timeout must be greater than zero
• rcp.stream_close_timeout must be greater than zero
• rcp.stream_open_timeout must be greater than zero

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1f32abef6710c9c4. Report an issue: GitHub.