hashicorp/nomad · error

Invalid file mode %q: Must be a valid Unix permission: %w

Error message

Invalid file mode %q: Must be a valid Unix permission: %w

What it means

writeTemplate validation guard: the perms value parsed as octal but includes non-permission bits (fileMode.Perm() != fileMode), e.g. setuid/directory bits, which are not allowed for rendered files; rendering aborts.

Source

Thrown at client/allocrunner/taskrunner/template/renderer/z_template_render.go:134

	}

	destPath, err = sandbox(sandboxPath, destPath) // platform-specific sandboxing
	if err != nil {
		return nil, fmt.Errorf("failed to sandbox alloc dir %q: %w", sandboxPath, err)
	}

	// perms must parse into a valid file permission
	fileMode := os.FileMode(DefaultFilePerms)
	if perms != "" {
		fileModeInt, err := strconv.ParseUint(perms, 8, 32)
		if err != nil {
			return nil, fmt.Errorf(
				"Invalid file mode %q: Must be a valid octal number: %w", perms, err)

		}
		fileMode = fs.FileMode(fileModeInt)
		if fileMode.Perm() != fileMode {
			return nil, fmt.Errorf(
				"Invalid file mode %q: Must be a valid Unix permission: %w", perms, err)
		}
	}

	input := &renderer.RenderInput{
		Backup:         false,
		Contents:       contents.Bytes(),
		CreateDestDirs: true,
		Dry:            false,
		DryStream:      nil,
		Path:           destPath,
		Perms:          fileMode,
		User:           user,
		Group:          group,
	}

	return renderer.Render(input)
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Use only permission bits (max 0777) in the template perms field
2. Remove special bits like setuid from the perms value

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/template/renderer/z_template_render.go:134 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6b84ffd6bc92eb3f. Report an issue: GitHub.