hashicorp/nomad · error

Docker privileged mode is disabled on this Nomad agent

Error message

Docker privileged mode is disabled on this Nomad agent

What it means

The Docker driver only applies the privileged flag when the Nomad agent's client-level allow_privileged option is enabled. If a task's driver config sets privileged = true but the agent has not opted in, createContainerConfig fails fast. This is an intentional operator-controlled safety gate.

Source

Thrown at drivers/docker/driver.go:1212

		Config: driverConfig.Logging.Config,
	}

	if hostConfig.LogConfig.Type == "" && hostConfig.LogConfig.Config == nil {
		logger.Trace("no docker log driver provided, defaulting to plugin config")
		hostConfig.LogConfig.Type = d.config.Logging.Type
		hostConfig.LogConfig.Config = d.config.Logging.Config
	}

	logger.Debug("configured resources",
		"memory", hostConfig.Memory, "memory_reservation", hostConfig.MemoryReservation,
		"cpu_shares", hostConfig.CPUShares, "cpu_quota", hostConfig.CPUQuota,
		"cpu_period", hostConfig.CPUPeriod)

	logger.Debug("binding directories", "binds", hclog.Fmt("%#v", hostConfig.Binds))

	//  set privileged mode
	if driverConfig.Privileged && !d.config.AllowPrivileged {
		return c, fmt.Errorf(`Docker privileged mode is disabled on this Nomad agent`)
	}
	hostConfig.Privileged = driverConfig.Privileged

	// get docker client info (we need to know the runtime to adjust
	// OS-specific capabilities)
	client, err := d.getDockerClient()
	if err != nil {
		return c, err
	}
	ver, err := client.ServerVersion(d.ctx, mclient.ServerVersionOptions{})
	if err != nil {
		return c, err
	}

	// set add/drop capabilities
	if hostConfig.CapAdd, hostConfig.CapDrop, err = capabilities.Delta(
		capabilities.DockerDefaults(system.VersionResponse{
			Platform: system.PlatformInfo{

View on GitHub (pinned to 482b49bf1a)

Solutions

1. In the agent's client config set allow_privileged = true under the plugin docker configuration and restart the agent
2. If privilege is not truly required, remove privileged = true from the task's docker driver config and use capabilities instead
3. Run the workload on a client pool whose agents allow privileged containers

Example fix

// before (agent config)
plugin "docker" {
  config { }
}
// after
plugin "docker" {
  config {
    allow_privileged = true
  }
}

if jobUsesPrivileged && !agentAllowsPrivileged {
  return errors.New("job requires privileged; agent must set allow_privileged = true")
}

func privilegedAllowed(cfg ClientConfig) bool { return cfg.PluginDocker.AllowPrivileged }

err := client.StartTask(task); if err != nil && strings.Contains(err.Error(), "privileged mode is disabled") { alertOperator("enable allow_privileged") }

When it happens

Trigger: StartTask -> createContainerConfig sees driverConfig.Privileged == true while d.config.AllowPrivileged is false (agent client config lacks allow_privileged = true).

Common situations: Jobs needing Docker-in-Docker, fuse, or kernel access are submitted to agents that never enabled allow_privileged; a job template was copied from a cluster where the flag was enabled to one where it is not.

Related errors

• running container as ContainerAdmin is unsafe; change the co
• failed to reattach to docker logger process: %v
• failed to launch docker logger plugin: %v
• failed to launch docker logger process %s: %v
• failed to get docker client: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5651f5afffb51d42. Report an issue: GitHub.