What causes "failed to build mount for resolv.conf: %v" in hashicorp/nomad?

Check the task's dns stanza in the job file: servers, searches, options must be valid non-empty values.

failed to build mount for resolv.conf: %v

Error message

failed to build mount for resolv.conf: %v

What it means

When the task specifies DNS configuration, StartTask asks resolvconf.GenerateDNSMount to build a resolv.conf mount for the task directory. If that fails (typically inability to write the generated resolv.conf into the task dir, or an invalid DNS config), the driver wraps the error with this message. This happens before the executor is launched.

Source

Thrown at drivers/java/driver.go:478

	handle.Config = cfg

	pluginLogFile := filepath.Join(cfg.TaskDir().Dir, "executor.out")
	executorConfig := &executor.ExecutorConfig{
		LogFile:     pluginLogFile,
		LogLevel:    "debug",
		FSIsolation: driverCapabilities.FSIsolation == fsisolation.Chroot,
		Compute:     d.nomadConfig.Topology.Compute(),
	}

	user := cfg.User
	if user == "" && runtime.GOOS != "windows" {
		user = "nobody"
	}

	if cfg.DNS != nil {
		dnsMount, err := resolvconf.GenerateDNSMount(cfg.TaskDir().Dir, cfg.DNS)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to build mount for resolv.conf: %v", err)
		}
		cfg.Mounts = append(cfg.Mounts, dnsMount)
	}

	caps, err := capabilities.Calculate(
		capabilities.NomadDefaults(), d.config.AllowCaps, driverConfig.CapAdd, driverConfig.CapDrop,
	)
	if err != nil {
		return nil, nil, err
	}
	d.logger.Debug("task capabilities", "capabilities", caps)

	exec, pluginClient, err := executor.CreateExecutor(
		d.logger.With("task_name", handle.Config.Name, "alloc_id", handle.Config.AllocID),
		d.nomadConfig, executorConfig)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create executor: %v", err)
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

Check the task's dns stanza in the job file: servers, searches, options must be valid non-empty values.
Verify the task directory exists and is writable by the Nomad client / task user.
Check client disk space and permissions on the alloc dir.
Remove or correct the dns block if the driver/task doesn't need custom DNS, then retry the allocation.

Example fix

// before
  dns {
    servers = ["  "]
  }
// after
  dns {
    servers = ["1.1.1.1", "8.8.8.8"]
  }

Defensive patterns

Strategy: validation

Validate before calling

// validate dns stanza and task dir writability before StartTask
if cfg.DNS != nil {
    if len(cfg.DNS.Servers) == 0 {
        return errors.New("dns block present but no servers configured")
    }
    if err := os.MkdirAll(cfg.TaskDir().Dir, 0o755); err != nil {
        return fmt.Errorf("task dir not usable for resolv.conf mount: %w", err)
    }
}

Try / catch

_, _, err := driver.StartTask(cfg)
if err != nil && strings.Contains(err.Error(), "failed to build mount for resolv.conf") {
    // drop or fix the dns block and resubmit
    return fmt.Errorf("check job dns stanza and task dir permissions: %w", err)
}

Prevention

Keep dns blocks minimal and valid (servers as IP strings).
Ensure alloc/task dirs exist and are writable by the client and task user.
Monitor client disk space; full disks break generated mount files.
Test dns blocks on a dev client before production rollout.

When it happens

Trigger: Calling StartTask with cfg.DNS set while GenerateDNSMount fails — e.g. the task directory doesn't exist or isn't writable, the DNS stanza contains no/invalid servers, or the underlying file write for the mount fails.

Common situations: Job 'dns' blocks with malformed 'servers'/'options' lists; task dir not yet created or permission problems (running as 'nobody'); client filesystem full or read-only; DNS blocks combined with drivers/fsisolation setups that don't expect mounts.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a2cf8043fde24020. Report an issue: GitHub.