hashicorp/nomad · error

Failed to open auth config file: %v, error: %v

Error message

Failed to open auth config file: %v, error: %v

What it means

loadDockerConfig opens the Docker auth config file (e.g. config.json) at a given path. If os.Open fails, the error is wrapped as 'Failed to open auth config file' including the path and OS error. This happens before parsing, so the file could not be read at all.

Source

Thrown at drivers/docker/utils.go:69

		tag = ""
	}

	return repo, tag, nil
}

func dockerImageRef(repo string, tag string) string {
	if tag == "" {
		return repo
	}
	return fmt.Sprintf("%s:%s", repo, tag)
}

// loadDockerConfig loads the docker config at the specified path, returning an
// error if it couldn't be read.
func loadDockerConfig(file string) (*configfile.ConfigFile, error) {
	f, err := os.Open(file)
	if err != nil {
		return nil, fmt.Errorf("Failed to open auth config file: %v, error: %v", file, err)
	}
	defer f.Close()

	cfile := new(configfile.ConfigFile)
	if err = cfile.LoadFromReader(f); err != nil {
		return nil, fmt.Errorf("Failed to parse auth config file: %v", err)
	}
	return cfile, nil
}

// repositoryInfo contains the subset of repository metadata needed for auth
// lookup against Docker config files and credential helpers.
type repositoryInfo struct {
	Index *registrytypes.IndexInfo
}

// parseRepositoryInfo takes a repo and returns the repository metadata needed
// for interacting with a Docker config object.

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the auth config path exists and is readable by the Nomad agent user (ls -l, test with sudo -u nomad cat)
2. Fix the docker.auth.config path in the client plugin configuration
3. Correct file ownership/permissions (chown/chmod) or SELinux context on the file
4. If the file was meant to be optional, ensure the caller checks existence before invoking

Example fix

# before
sudo -u nomad cat /home/me/.docker/config.json  # Permission denied
# after
sudo chown nomad:nomad /home/me/.docker/config.json && chmod 600 /home/me/.docker/config.json

const authCfg = "/etc/nomad.d/docker-auth.json"
if fi, err := os.Stat(authCfg); err != nil || fi.Mode().Perm()&0o400 == 0 {
    return fmt.Errorf("auth config %s missing or unreadable by agent user", authCfg)
}

When it happens

Trigger: Calling loadDockerConfig(file) when the file does not exist, the path is wrong, or the Nomad agent process lacks read permission on the file or its directory.

Common situations: DOCKER_AUTH_CONFIG / docker.config path misconfigured; file deleted or rotated after registration; agent running as a user without access to the user's ~/.docker/config.json; SELinux/AppArmor blocking the read.

Related errors

• Failed to parse auth config file: %v
• Failed to find docker auth for repo %q: %v
• no signed workload identity available
• plugin not executable
• JWT login returned an empty secret

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/49f371d7ad8a3b03. Report an issue: GitHub.