hashicorp/nomad · error

Failed to lookup user: %v

Error message

Failed to lookup user: %v

What it means

In TaskDir.Build for Unveil-based filesystem isolation (BSD/Unveil sandboxing path), Nomad resolves the task's username with dynamic.LookupUser to bind-mount the task dirs under client.mounts_dir/<task>. This error wraps the user lookup failure, aborting Build because the task's uid/gid cannot be determined.

Source

Thrown at client/allocdir/task_dir.go:181

		}
	}

	if err := t.MakeSecretsDirs(); err != nil {
		return err
	}

	// Build chroot if chroot filesystem isolation is going to be used
	if fsi == fsisolation.Chroot {
		if err := t.buildChroot(chroot); err != nil {
			return err
		}
	}

	// Only bind mount the task alloc/task dirs to the client.mounts_dir/<task>
	if fsi == fsisolation.Unveil {
		uid, gid, _, err := dynamic.LookupUser(username)
		if err != nil {
			return fmt.Errorf("Failed to lookup user: %v", err)
		}

		nobodyUID, nobodyGID, _, err := dynamic.LookupUser("nobody")
		if err != nil {
			return fmt.Errorf("Failed to lookup nobody user: %v", err)
		}

		// create the task unique directory under the client mounts path
		parent := filepath.Dir(t.MountsAllocDir)
		if err = os.MkdirAll(parent, fileMode710); err != nil {
			return fmt.Errorf("Failed to create task mount directory: %v", err)
		}
		if err = os.Chown(parent, uid, gid); err != nil {
			return fmt.Errorf("Failed to chown task mount directory: %v", err)
		}

		// create the taskdir mount point
		if err = mountDir(t.Dir, t.MountsTaskDir, uid, gid, fileMode710); err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the user exists on the client host: `getent passwd <username>`; create it if missing.
2. Correct the `user` field in the job's task/group configuration if it is a typo.
3. Fix host NSS/LDAP configuration if lookups are delegated and currently failing.
4. Rerun the allocation after the user is resolvable.

Example fix

// before: jobspec references host-missing user
task "web" {
  user = "webapp"
}
// after: create the user on the Nomad client host
sudo useradd -r -s /usr/sbin/nologin webapp

// validate the jobspec user resolves on the client host before submitting
func ensureUser(name string) error {
    if _, err := user.Lookup(name); err != nil {
        return fmt.Errorf("task user %q not resolvable on client: %w", name, err)
    }
    return nil
}

if err := td.Build(); err != nil {
    if strings.Contains(err.Error(), "Failed to lookup user") {
        log.Printf("create the task user on the client host or fix jobspec 'user' field: %v", err)
    }
    return err
}

When it happens

Trigger: fsi == fsisolation.Unveil and dynamic.LookupUser(username) failed — the configured task user does not exist on the client host (or in its NSS sources).

Common situations: Jobspec sets a `user` that only exists in a container image, not on the host; typo in the user field; host provisioned without the service account; LDAP/NSS outage preventing resolution.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• users: unable to parse uid/gid from username
• Unable to find nobody user: %w
• Unable to convert Uid to an int: %w
• Unable to convert Gid to an int: %w
• Failed to mount shared directory for task: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/cb57220805f034ef. Report an issue: GitHub.