What causes "Task group service check validation failed: %v" in hashicorp/nomad?

Set the `task` field on the script check to a valid task name in the group.

Task group service check validation failed: %v

Error message

Task group service check validation failed: %v

What it means

TaskGroup.Validate calls tg.validateScriptChecksInGroupServices() and wraps failures as "Task group service check validation failed: %v", appending to the job multierror. It targets script-type checks attached to group-level services, which carry extra restrictions (task to execute in, driver support, consul/nomad provider capabilities).

Source

Thrown at nomad/structs/structs.go:7306

				"Task group volume validation for %s failed: %v", name, err))
		}
	}

	// Validate task group and task network resources
	if err := tg.validateNetworks(); err != nil {
		outer := fmt.Errorf("Task group network validation failed: %v", err)
		mErr = multierror.Append(mErr, outer)
	}

	// Validate task group and task services
	if err := tg.validateServices(); err != nil {
		outer := fmt.Errorf("Task group service validation failed: %v", err)
		mErr = multierror.Append(mErr, outer)
	}

	// Validate group service script-checks
	if err := tg.validateScriptChecksInGroupServices(); err != nil {
		outer := fmt.Errorf("Task group service check validation failed: %v", err)
		mErr = multierror.Append(mErr, outer)
	}

	// Validate the scaling policy
	if err := tg.validateScalingPolicy(j); err != nil {
		outer := fmt.Errorf("Task group scaling policy validation failed: %v", err)
		mErr = multierror.Append(mErr, outer)
	}

	// Validate the tasks
	for _, task := range tg.Tasks {
		if err := task.Validate(j.Type, tg); err != nil {
			outer := fmt.Errorf("Task %s validation failed: %v", task.Name, err)
			mErr = multierror.Append(mErr, outer)
		}
	}

	return mErr.ErrorOrNil()

View on GitHub (pinned to 482b49bf1a)

Solutions

Set the `task` field on the script check to a valid task name in the group.
Ensure that task's driver supports script checks (exec capability) on the target clients.
Switch to http/tcp checks if the environment (provider/ACLs) disallows script checks.

Example fix

// before
service {
  name = "web"
  check {
    type = "script"
    command = "/bin/check.sh"
  }
}
// after
service {
  name = "web"
  check {
    type = "script"
    task = "app"
    command = "/bin/check.sh"
  }
}

Defensive patterns

Strategy: validation

Validate before calling

// Go: script checks in group services must target a task
for _, s := range tg.Services {
  for _, c := range s.Checks {
    if c.Type == "script" && c.TaskName == "" {
      return fmt.Errorf("service %q: script check requires task field", s.Name)
    }
  }
}

Prevention

Always set `task` on script checks attached to group services.
Verify the target task's driver supports script execution.
Fall back to http/tcp checks when script checks are unsupported in the environment.

When it happens

Trigger: Submitting a group `service` with a `check` of type "script" that is invalid: missing `task` field naming a task in the group, the named task's driver lacking script exec support, script checks unsupported for provider = "nomad", or invalid splay/timeout combinations.

Common situations: Adding a script check to a group service without specifying which task runs it; enabling script checks with a driver that can't exec (e.g. isolated runtimes); upgrading Nomad/Consul where script check support or ACL requirements changed.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/10808a0185c57417. Report an issue: GitHub.