hashicorp/nomad · error

filesystem functions disabled

Error message

filesystem functions disabled

What it means

Same family as 2003 but thrown from the Impl (evaluation) path: when a disabled filesystem HCL function is actually invoked, evaluation returns 'filesystem functions disabled'. jobspec2 intentionally refuses filesystem access during job parsing.

Solutions

1. Inline the file content directly in the jobspec or use a template stanza in the job.
2. Move the value into a variable and supply it via var-file/-var at parse time.
3. Use Nomad's artifact + template blocks to fetch and render content at runtime instead of parse time.
4. Preprocess the jobspec with your own tooling before submitting if file interpolation is required.

Example fix

// before
command = templatefile("app.tpl", {})

// after
template {
  data     = file content inlined or via artifact
  destination = "local/app.tpl"
}

if strings.Contains(jobHCL, "templatefile(") || strings.Contains(jobHCL, "file(") {
    return errors.New("filesystem functions are disabled in jobspec evaluation")
}

if err != nil && strings.Contains(err.Error(), "filesystem functions disabled") {
    // replace the function call with a literal or template stanza
}

When it happens

Trigger: Calling a filesystem HCL function in a jobspec that passes type checking but fails at evaluation time because the function set was built with filesystem functions disabled.

Common situations: Reusing Terraform-style HCL that reads local files; teams migrating configs between tools; attempts to template job files with local file contents at submit time.

Related errors

• filesystem function disabled
• cannot serialize
• <combined HCL diagnostics from str.String()>
• unable to parse var content
• unable to parse var file

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/bbc46a2448b3ceeb. Report an issue: GitHub.

Appendix: source

Thrown at jobspec2/functions.go:136

		funcs["sha1"] = crypto.Sha1Func
	}

	return funcs
}

func guardFS(allowFS bool, fn function.Function) function.Function {
	if allowFS {
		return fn
	}

	spec := &function.Spec{
		Params:   fn.Params(),
		VarParam: fn.VarParam(),
		Type: func([]cty.Value) (cty.Type, error) {
			return cty.DynamicPseudoType, fmt.Errorf("filesystem function disabled")
		},
		Impl: func([]cty.Value, cty.Type) (cty.Value, error) {
			return cty.DynamicVal, fmt.Errorf("filesystem functions disabled")
		},
	}

	return function.New(spec)
}

View on GitHub (pinned to 482b49bf1a)