service %q cannot use address_mode="alloc", only services de

Error message

service %q cannot use address_mode="alloc", only services defined in a "group" block can use this mode

What it means

Nomad's job validation (validateServices for a task group) rejects address_mode="alloc" on services that are not defined directly in a "group" block. The alloc address mode uses the allocation's own address, which is only meaningful at group level; task-level services must resolve addresses via the driver or a port label. This error is accumulated into a MultiError during job submission (`nomad job run` / Job.Register).

Source

Thrown at nomad/structs/structs.go:8486

	// Ensure that services don't ask for nonexistent ports and their names are
	// unique.
	servicePorts := make(map[string]map[string]struct{})
	addServicePort := func(label, service string) {
		if _, ok := servicePorts[label]; !ok {
			servicePorts[label] = map[string]struct{}{}
		}
		servicePorts[label][service] = struct{}{}
	}
	knownServices := make(map[string]struct{})
	for i, service := range t.Services {
		if err := service.Validate(); err != nil {
			outer := fmt.Errorf("service[%d] %+q validation failed: %s", i, service.Name, err)
			mErr.Errors = append(mErr.Errors, outer)
		}

		if service.AddressMode == AddressModeAlloc {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("service %q cannot use address_mode=\"alloc\", only services defined in a \"group\" block can use this mode", service.Name))
		}

		if service.AddressMode == AddressModeAllocIPv6 {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("service %q cannot use address_mode=\"alloc_ipv6\", only services defined in a \"group\" block can use this mode", service.Name))
		}

		// Ensure that services with the same name are not being registered for
		// the same port
		if _, ok := knownServices[service.Name+service.PortLabel]; ok {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("service %q is duplicate", service.Name))
		}
		knownServices[service.Name+service.PortLabel] = struct{}{}

		if service.PortLabel != "" {
			if service.AddressMode == "driver" {
				// Numeric port labels are valid for address_mode=driver
				_, err := strconv.Atoi(service.PortLabel)
				if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove `address_mode = "alloc"` from the task-level service block, or delete the line to use the default driver-based address mode.
Move the service block up to the `group` level if you genuinely need allocation-wide addressing.
Use `address_mode = "driver"` (default) or "host" with a proper port_label on the task-level service.
Validate the job locally with `nomad job validate <file>` before submission to catch it early.

Example fix

// before (task-level service)
task "web" {
  service {
    name = "api"
    port = "http"
    address_mode = "alloc"
  }
}

// after
task "web" {
  service {
    name = "api"
    port = "http"
    # address_mode removed (defaults to "driver")
  }
}

Defensive patterns

Strategy: validation

Validate before calling

// Pre-validate job HCL/JSON before submission:
// for each task-level service, ensure address_mode != "alloc"
for _, tg := range job.TaskGroups {
  for _, t := range tg.Tasks {
    for _, s := range t.Services {
      if s.AddressMode == "alloc" {
        return fmt.Errorf("task %s: service %q cannot use address_mode=alloc at task level", t.Name, s.Name)
      }
    }
  }
}
// or simply: nomad job validate job.hcl

Prevention

Only set address_mode on group-level service blocks
Run `nomad job validate` in CI before every job submit
Omit address_mode and let Nomad default to "driver" unless alloc addressing is required

When it happens

Trigger: Submitting a job where a `service` block nested inside a `task` (or inside a task within a group) sets `address_mode = "alloc"`. The check runs when service.AddressMode == structs.AddressModeAlloc during group service validation.

Common situations: Copy-pasting a group-level service stanza into a task stanza without removing address_mode="alloc"; upgrading jobs from older Nomad versions where address modes behaved differently; confusing group-level vs task-level service semantics in job HCL/JSON.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5ecb898969bee8da. Report an issue: GitHub.