What causes "failed host user validation: %v" in hashicorp/nomad?

Create the user on the Nomad client host (useradd) or use an existing host account.

failed host user validation: %v

Error message

failed host user validation: %v

What it means

StartTask validates that the user the task will run as exists on the host with valid UID/GID via d.userIDValidator.HasValidIDs. exec tasks run as real host users (unlike docker with namespacing), so an unknown or invalid user aborts the launch.

Source

Thrown at drivers/exec/driver.go:479

	}

	var driverConfig TaskConfig
	if err := cfg.DecodeDriverConfig(&driverConfig); err != nil {
		return nil, nil, fmt.Errorf("failed to decode driver config: %v", err)
	}

	if err := driverConfig.validate(); err != nil {
		return nil, nil, fmt.Errorf("failed driver config validation: %v", err)
	}

	if cfg.User == "" {
		cfg.User = "nobody"
	}

	d.logger.Debug("setting up user", "user", cfg.User)

	if err := d.userIDValidator.HasValidIDs(cfg.User); err != nil {
		return nil, nil, fmt.Errorf("failed host user validation: %v", err)
	}

	d.logger.Info("starting task", "driver_cfg", hclog.Fmt("%+v", driverConfig))
	handle = drivers.NewTaskHandle(taskHandleVersion)
	handle.Config = cfg

	pluginLogFile := filepath.Join(cfg.TaskDir().Dir, "executor.out")
	executorConfig := &executor.ExecutorConfig{
		LogFile:     pluginLogFile,
		LogLevel:    "debug",
		FSIsolation: true,
		Compute:     d.compute,
	}

	user := cfg.User
	if cfg.DNS != nil {
		dnsMount, err := resolvconf.GenerateDNSMount(cfg.TaskDir().Dir, cfg.DNS)
		if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

Create the user on the Nomad client host (useradd) or use an existing host account.
Remove the 'user' field from the task to accept the default "nobody".
Verify the account resolves with 'id <user>' on the client node.
If using an infrastructure-managed account store, ensure nsswitch/sssd is configured on the client.

Example fix

// before (job spec)
task "web" {
  user = "webapp" // not a host user
}
// after
# on the Nomad client host:
# sudo useradd -r webapp
task "web" {
  user = "webapp"
}

Defensive patterns

Strategy: validation

Validate before calling

// ensure the user resolves on the client host before launching
if out, err := exec.Command("id", user).CombinedOutput(); err != nil {
    return fmt.Errorf("user %q does not exist on host: %s", user, out)
}

Prevention

Provision task users with config management on every Nomad client.
Prefer existing system accounts or the implicit "nobody" default.
Verify NSS/LDAP/SSSD resolution works on client nodes if accounts are centralized.
Run 'id <user>' as part of node readiness checks.

When it happens

Trigger: TaskConfig.User names a user missing from /etc/passwd, a user with no valid UID/GID, or an invalid user string when chroot/isolation requires a resolvable host account.

Common situations: Job sets user = "appuser" but that account exists only in a container image, not on the Nomad host; LDAP-managed accounts not resolvable on the client node; typo'd username.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/3ed0da1f8fc02f23. Report an issue: GitHub.