hashicorp/nomad · error

Failed to lookup nobody user: %v

Error message

Failed to lookup nobody user: %v

What it means

TaskDir.Build (Unveil fs-isolation mode) resolves the task's runtime user and the 'nobody' account with dynamic.LookupUser to set ownership on bind-mount points. This error wraps the failure of the 'nobody' user lookup on the host. Nomad requires a local 'nobody' user whenever Unveil isolation mounts the shared alloc dir, because the alloc share is chowned to nobody:nobody.

Source

Thrown at client/allocdir/task_dir.go:186

	}

	// Build chroot if chroot filesystem isolation is going to be used
	if fsi == fsisolation.Chroot {
		if err := t.buildChroot(chroot); err != nil {
			return err
		}
	}

	// Only bind mount the task alloc/task dirs to the client.mounts_dir/<task>
	if fsi == fsisolation.Unveil {
		uid, gid, _, err := dynamic.LookupUser(username)
		if err != nil {
			return fmt.Errorf("Failed to lookup user: %v", err)
		}

		nobodyUID, nobodyGID, _, err := dynamic.LookupUser("nobody")
		if err != nil {
			return fmt.Errorf("Failed to lookup nobody user: %v", err)
		}

		// create the task unique directory under the client mounts path
		parent := filepath.Dir(t.MountsAllocDir)
		if err = os.MkdirAll(parent, fileMode710); err != nil {
			return fmt.Errorf("Failed to create task mount directory: %v", err)
		}
		if err = os.Chown(parent, uid, gid); err != nil {
			return fmt.Errorf("Failed to chown task mount directory: %v", err)
		}

		// create the taskdir mount point
		if err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {
			return fmt.Errorf("Failed to mount task dir: %v", err)
		}

		// create the allocdir mount point (owned by nobody)
		if err = mountDir(filepath.Join(t.AllocDir, "/alloc"), t.MountsAllocDir, nobodyUID, nobodyGID, fileMode777); err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add the 'nobody' user to the host (e.g. `useradd -u 65534 nobody` or ensure the distro's shadow/nss package provides it)
2. Verify /etc/passwd contains a nobody entry and /etc/nsswitch.conf has `passwd: files` (or a working NSS backend)
3. If running the client in a container, ensure /etc/passwd is mounted/contains nobody
4. Upgrade Nomad or pin to a chroot/image-based isolation driver if Unveil mode is not required

Example fix

# before (host lacks nobody)
$ getent passwd nobody  # empty
# after
$ useradd -u 65534 -g nogroup -s /sbin/nologin nobody
$ getent passwd nobody
nobody:x:65534:65534:nobody:/nonexistent:/sbin/nologin

if out, err := exec.Command("getent", "passwd", "nobody").Output(); err != nil || len(out) == 0 {
    return fmt.Errorf("host missing 'nobody' user required for Unveil isolation: %w", err)
}

func hasNobodyUser() bool {
    _, err := user.Lookup("nobody")
    return err == nil
}

When it happens

Trigger: Calling TaskDir.Build with fsi == fsisolation.Unveil on a host where the 'nobody' passwd entry does not exist or the user database is unreadable; dynamic.LookupUser("nobody") returns an error.

Common situations: Minimal container images (distroless, scratch, alpine variants) or stripped-down hosts without a /etc/passwd 'nobody' entry; NSS misconfiguration (e.g. broken /etc/nsswitch.conf) preventing passwd resolution; running the Nomad client in a userns/container that hides system users.

Related errors

• failed to remove alloc dir %q: %w
• Failed to make the alloc directory %v: %w
• Failed to create task mount directory: %v
• Failed to mount task dir: %v
• Failed to mount alloc dir: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/bb5cdadaf375633a. Report an issue: GitHub.