hashicorp/nomad · error

error making %q executable: %s

Error message

error making %q executable: %s

What it means

This error is wrapped by makeExecutable in the Nomad executor when os.Chmod fails while trying to grant at least mode 0555 (read+execute) to the task's binary. Nomad requires the binary to be executable inside the task's chroot, so before launching it checks the current permission bits and ORs in 0555 if they are missing. The underlying chmod failure is embedded in the %s suffix.

Source

Thrown at drivers/shared/executor/executor.go:791

func makeExecutable(binPath string) error {
	if runtime.GOOS == "windows" {
		return nil
	}

	fi, err := os.Stat(binPath)
	if err != nil {
		if os.IsNotExist(err) {
			return fmt.Errorf("binary %q does not exist", binPath)
		}
		return fmt.Errorf("specified binary is invalid: %v", err)
	}

	// If it is not executable, make it so.
	perm := fi.Mode().Perm()
	req := os.FileMode(0555)
	if perm&req != req {
		if err := os.Chmod(binPath, perm|req); err != nil {
			return fmt.Errorf("error making %q executable: %s", binPath, err)
		}
	}
	return nil
}

// SupportedCaps returns a list of all supported capabilities in kernel.
func SupportedCaps(allowNetRaw bool) []string {
	var allCaps []string
	list, _ := capability.ListSupported()
	for _, cap := range list {
		if !allowNetRaw && cap == capability.CAP_NET_RAW {
			continue
		}
		allCaps = append(allCaps, fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())))
	}
	return allCaps
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check ownership and permissions of the binary path (ls -l) and ensure the Nomad/executor process user can chmod it
2. Verify the filesystem backing the task dir is writable and not mounted read-only or noexec
3. Confirm lookupTaskBin returned the host path of the binary and that it still exists at chmod time
4. Re-download/re-stage the artifact if the binary vanished mid-launch

fi, err := os.Stat(binPath)
if err != nil { return fmt.Errorf("binary missing: %w", err) }
if fi.Mode().Perm()&0o555 != 0o555 {
    if err := os.Chmod(binPath, fi.Mode().Perm()|0o555); err != nil {
        return fmt.Errorf("pre-flight chmod failed for %s: %w", binPath, err)
    }
}

When it happens

Trigger: os.Chmod(binPath, perm|0555) returns an error: the file is on a read-only filesystem, the executor user lacks ownership/chmod rights, or the binary path was removed between the stat and the chmod.

Common situations: Task binary mounted from a read-only volume or artifact; the alloc dir lives on a filesystem mounted noexec/immutable; running the driver as an unprivileged user without write access to the binary; binary deleted by another task or GC between check and chmod.

Related errors

• Chmod(%v) failed: %w
• error chmoding file %w
• failed to change directory permissions for the AllocDir: %v
• error setting directory permission mode: %w
• plugin not executable

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f36e23086d0b9267. Report an issue: GitHub.