hashicorp/nomad · error

filesystem function disabled

Error message

filesystem function disabled

What it means

jobspec2 deliberately disables filesystem-related HCL functions (e.g. file(), templatefile()). The function spec's Type and Impl both return this error, so any use of a filesystem function during type/eval fails with 'filesystem function disabled'.

Source

Thrown at jobspec2/functions.go:133

	if !fips140.Enabled() {
		funcs["md5"] = crypto.Md5Func
		funcs["sha1"] = crypto.Sha1Func
	}

	return funcs
}

func guardFS(allowFS bool, fn function.Function) function.Function {
	if allowFS {
		return fn
	}

	spec := &function.Spec{
		Params:   fn.Params(),
		VarParam: fn.VarParam(),
		Type: func([]cty.Value) (cty.Type, error) {
			return cty.DynamicPseudoType, fmt.Errorf("filesystem function disabled")
		},
		Impl: func([]cty.Value, cty.Type) (cty.Value, error) {
			return cty.DynamicVal, fmt.Errorf("filesystem functions disabled")
		},
	}

	return function.New(spec)
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove the filesystem function from the jobspec and inline the file's contents literally.
2. Pass the needed data via var declarations (-var / var-file) instead of reading files in HCL.
3. Use template/user variables or the scheduler's supported mechanisms (e.g. artifact blocks, template stanzas) to bring file content in at runtime.
4. If you truly need FS functions, use a parse API variant that enables them, if available.

Example fix

// before
value = file("config.txt")

// after
variable "config" { type = string }
value = var.config // pass with -var config=$(cat config.txt)

// Scan the jobspec source for disabled FS functions before parsing
re := regexp.MustCompile(`\b(file|fileexists|abspath|basename|dirname)\s*\(`)
if re.MatchString(spec) {
    return errors.New("jobspec uses disabled filesystem functions; inline content or use vars")
}

if err := ParseWithConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "filesystem function") {
        // rewrite spec / instruct user to inline the value
    }
}

When it happens

Trigger: Evaluating a jobspec whose HCL invokes a filesystem function (file, fileexists, etc.) when functions.go builds the function set with the FS-disabled option; the error surfaces during type checking of the call.

Common situations: Job specs written for tools that allow filesystem functions (like Terraform) being reused in Nomad jobspecs; attempting to read local files at job-parse time, which is intentionally disallowed for safety/determinism.

Related errors

• filesystem functions disabled
• <combined HCL diagnostics from str.String()>
• unable to parse var file: %v
• unable to parse var content: %v
• value is not known

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f20bd01a81437086. Report an issue: GitHub.