hashicorp/nomad · error

filesystem_isolation_extra_paths contains invalid lockdown p

Error message

filesystem_isolation_extra_paths contains invalid lockdown path %q

What it means

ArtifactConfig.Validate parses each entry of FilesystemIsolationExtraPaths with landlock.ParsePath; any entry that is not a valid absolute landlock-able path produces this error. It ensures extra isolation paths can actually be enforced by the kernel's landlock facility.

Source

Thrown at nomad/structs/config/artifact.go:246

		return fmt.Errorf("decompression_size_limit must not be nil")
	}
	if v, err := humanize.ParseBytes(*a.DecompressionSizeLimit); err != nil {
		return fmt.Errorf("decompression_size_limit is not a valid size: %w", err)
	} else if v > math.MaxInt64 {
		return fmt.Errorf("decompression_size_limit must be < %d but found %d", int64(math.MaxInt64), v)
	}

	if a.DisableArtifactInspection == nil {
		return fmt.Errorf("disable_artifact_inspection must be set")
	}

	if a.DisableFilesystemIsolation == nil {
		return fmt.Errorf("disable_filesystem_isolation must be set")
	}

	for _, p := range a.FilesystemIsolationExtraPaths {
		if _, err := landlock.ParsePath(p); err != nil {
			return fmt.Errorf("filesystem_isolation_extra_paths contains invalid lockdown path %q", p)
		}
	}

	if a.SetEnvironmentVariables == nil {
		return fmt.Errorf("set_environment_variables must be set")
	}

	return nil
}

func DefaultArtifactConfig() *ArtifactConfig {
	return &ArtifactConfig{
		// Read timeout for HTTP operations. Must be long enough to
		// accommodate large/slow downloads.
		HTTPReadTimeout: new("30m"),

		// Maximum download size. Must be large enough to accommodate
		// large downloads.

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change the listed path to an absolute, existing path landlock can parse
2. Remove entries that are not valid landlock paths
3. Verify each path exists on the agent host: ls <path>

Example fix

// before
filesystem_isolation_extra_paths = ["secrets"]
// after
filesystem_isolation_extra_paths = ["/etc/secrets"]

for _, p := range cfg.Artifact.FilesystemIsolationExtraPaths {
    if !filepath.IsAbs(p) {
        return fmt.Errorf("isolation path %q must be absolute", p)
    }
    if _, err := os.Stat(p); err != nil {
        return fmt.Errorf("isolation path %q not accessible: %w", p, err)
    }
}

When it happens

Trigger: A filesystem_isolation_extra_paths entry is not an existing/absolute path or otherwise rejected by landlock.ParsePath while Validate() runs on the artifact config.

Common situations: Typos or relative paths in the config (e.g. "data/secrets" instead of "/etc/secrets"); referencing non-existent directories; copying paths from another host with a different filesystem layout.

Related errors

• wait config is nil or empty
• retry config is nil or empty
• fingerprint name cannot be empty
• rcp.accept_backlog interval must be greater than zero
• rcp.keep_alive_interval must be greater than zero

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/71232badde474221. Report an issue: GitHub.