What causes "running as uid %d is disallowed" in hashicorp/nomad?

Change the task's user to a non-denied account (e.g. a dedicated low-privilege user outside denied ranges)

running as uid %d is disallowed

Error message

running as uid %d is disallowed

What it means

HasValidIDs checks the resolved UID against the driver's deniedUIDs set (a security policy of forbidden UID ranges configured on the client). This error means the task's user resolves to a UID that the administrator has explicitly disallowed for task execution.

Source

Thrown at drivers/shared/validators/validators.go:82

	return v, nil
}

// HasValidIDs is used when running a task to ensure the
// given user is in the ID range defined in the task config
func (v *Validator) HasValidIDs(userName string) error {
	user, err := users.Lookup(userName)
	if err != nil {
		return fmt.Errorf("failed to identify user %q: %w", userName, err)
	}

	uid, err := getUserID(user)
	if err != nil {
		return fmt.Errorf("validator: %w", err)
	}

	// check uids
	if v.deniedUIDs.Contains(uid) {
		return fmt.Errorf("running as uid %d is disallowed", uid)
	}

	gids, err := getGroupsID(user)
	if err != nil {
		return fmt.Errorf("validator:  %w", err)
	}

	// check gids
	for _, gid := range gids {
		if v.deniedGIDs.Contains(gid) {
			return fmt.Errorf("running as gid %d is disallowed", gid)
		}
	}

	return nil
}

// validateIDRange is used to ensure that the configuration for ID ranges is valid

View on GitHub (pinned to 482b49bf1a)

Solutions

Change the task's user to a non-denied account (e.g. a dedicated low-privilege user outside denied ranges)
If running as this UID is legitimate, ask the cluster operator to adjust the denied_host_uids policy in the client config
Verify the user's actual UID (id -u <user>) against the denied ranges documented in the client config
Do not run tasks as root — create a dedicated task user

Example fix

// before (job HCL) — root is denied
user = "root"
// after
user = "nomad-task"

Defensive patterns

Strategy: validation

Validate before calling

u, err := user.Lookup(userName)
if err != nil { return err }
uid, _ := strconv.Atoi(u.Uid)
if deniedUIDs.Contains(uid) {
    return fmt.Errorf("user %q (uid %d) is in a denied range; pick another user", userName, uid)
}

Prevention

Document the client's denied_host_uids policy for job authors
Run tasks as dedicated low-privilege users, never root or service accounts
Check id -u <user> against policy ranges in CI job linting

When it happens

Trigger: A task runs as a user whose UID falls in a denied range (typically UIDs of system/root-critical accounts, e.g. 0 or <100) when the client's validator was configured with denied_host_uids/denied GID ranges in the client config.

Common situations: Operator configured denied UID ranges (e.g. blocking root and service accounts) and a job tries to run as root or a service user; job migrated from a cluster without this policy to one with it; user account renumbered into a denied range.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/7f435118317deae9. Report an issue: GitHub.