What causes "Unable to find nobody user: %w" in hashicorp/nomad?

Ensure the 'nobody' user exists: verify `getent passwd nobody` returns an entry.

Unable to find nobody user: %w

Error message

Unable to find nobody user: %w

What it means

After relaxing directory permissions, dropDirPermissions (only when running as root, euid==0) tries to chown the directory to the 'nobody' user via users.Lookup("nobody"). This error means the 'nobody' account could not be resolved through the system user database, so the ownership downgrade could not be performed.

Source

Thrown at client/allocdir/fs_unix.go:48

	// secrets directory
	TaskSecretsContainerPath = filepath.Join("/", TaskSecrets)
)

// dropDirPermissions gives full access to a directory to all users and sets
// the owner to nobody.
func dropDirPermissions(path string, desired os.FileMode) error {
	if err := os.Chmod(path, desired|fileMode777); err != nil {
		return fmt.Errorf("Chmod(%v) failed: %w", path, err)
	}

	// Can't change owner if not root.
	if unix.Geteuid() != 0 {
		return nil
	}

	u, err := users.Lookup("nobody")
	if err != nil {
		return fmt.Errorf("Unable to find nobody user: %w", err)
	}

	uid, err := getUid(u)
	if err != nil {
		return err
	}

	gid, err := getGid(u)
	if err != nil {
		return err
	}

	if err := os.Chown(path, uid, gid); err != nil {
		return fmt.Errorf("Couldn't change owner/group of %v to (uid: %v, gid: %v): %w", path, uid, gid, err)
	}

	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

Ensure the 'nobody' user exists: verify `getent passwd nobody` returns an entry.
Add nobody to /etc/passwd (e.g. nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin) in minimal images.
Fix NSS configuration if user lookup is delegated to LDAP/SSSD and currently failing.
Upgrade/repair the base image of the Nomad client host or container.

Example fix

// before: scratch-based client image with no /etc/passwd entry
FROM scratch
// after: ensure nobody exists
FROM alpine:3
RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' >> /etc/passwd

Defensive patterns

Strategy: validation

Validate before calling

// host preflight (run at client bootstrap)
if _, err := user.Lookup("nobody"); err != nil {
    return fmt.Errorf("host missing 'nobody' user required by nomad: %w", err)
}

Try / catch

if err := td.Build(); err != nil {
    if strings.Contains(err.Error(), "Unable to find nobody user") {
        log.Printf("client host lacks nobody account; fix /etc/passwd or base image")
    }
    return err
}

Prevention

Include a standard /etc/passwd with nobody in minimal container images.
Add a host preflight check before registering the client.
Keep NSS configuration simple and functional on client hosts.

When it happens

Trigger: unix.Geteuid()==0 and users.Lookup("nobody") failed — the 'nobody' user is absent from /etc/passwd or any configured NSS source during allocation directory setup.

Common situations: Minimal container images (scratch/distroless) lacking the nobody entry; broken /etc/passwd or NSS configuration (missing libnss files); hosts where the distro names the account differently (e.g. 'nogroup' concerns, or nobody removed for hardening).

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2d0fbc2eef251d75. Report an issue: GitHub.