hashicorp/nomad · error

unable to lookup user's group membership: %v

Error message

unable to lookup user's group membership: %v

What it means

After resolving the user, setCmdUser enumerates the user's supplementary groups via u.GroupIds(). If the group membership query fails (getgrouplist/ NSS failure), the error is wrapped and returned so the command is not started with a wrong or partial group set.

Source

Thrown at drivers/shared/executor/executor_unix.go:70

	if err := proc.Signal(sig); err != nil && err.Error() != finishedErr {
		return fmt.Errorf("executor shutdown error: %v", err)
	}

	return nil
}

// setCmdUser takes a user id as a string and looks up the user, and sets the command
// to execute as that user.
func setCmdUser(cmd *exec.Cmd, userid string) error {
	u, err := users.Lookup(userid)
	if err != nil {
		return fmt.Errorf("failed to identify user %v: %v", userid, err)
	}

	// Get the groups the user is a part of
	gidStrings, err := u.GroupIds()
	if err != nil {
		return fmt.Errorf("unable to lookup user's group membership: %v", err)
	}

	gids := make([]uint32, len(gidStrings))
	for _, gidString := range gidStrings {
		u, err := strconv.ParseUint(gidString, 10, 32)
		if err != nil {
			return fmt.Errorf("unable to convert user's group to uint32 %s: %v", gidString, err)
		}

		gids = append(gids, uint32(u))
	}

	// Convert the uid and gid
	uid, err := strconv.ParseUint(u.Uid, 10, 32)
	if err != nil {
		return fmt.Errorf("unable to convert userid to uint32: %w", err)
	}
	gid, err := strconv.ParseUint(u.Gid, 10, 32)

View on GitHub (pinned to 482b49bf1a)

Solutions

  1. Run 'id <username>' as the Nomad user to reproduce and see the underlying group-lookup failure.
  2. Restart/repair the NSS backend (sssd, nscd, nslcd) or fix /etc/nsswitch.conf group line.
  3. Ensure /etc/group exists and is readable in the container/chroot.
  4. As a workaround, run the task as a user whose groups resolve locally (e.g. in /etc/group).

Example fix

// before
$ id appuser
id: 'appuser': failed to find groups
// after
$ systemctl restart sssd  # or fix /etc/nsswitch.conf: group: files ldap
Defensive patterns

Strategy: validation

Validate before calling

// Go: confirm group enumeration works before scheduling
if u, err := user.Lookup(taskUser); err == nil {
    if _, err := u.GroupIds(); err != nil {
        return fmt.Errorf("cannot enumerate groups for %q: %w", taskUser, err)
    }
}

Type guard

func groupsResolve(userid string) bool {
    u, err := user.Lookup(userid)
    if err != nil {
        return false
    }
    _, err = u.GroupIds()
    return err == nil
}

Try / catch

if err := exec.SetUser(cmd, userid); err != nil {
    if strings.Contains(err.Error(), "group membership") {
        // NSS/group backend issue: alert on sssd/nscd health
    }
    return err
}

Prevention

When it happens

Trigger: users.Lookup succeeds but u.GroupIds() errors — typically NSS backend failure (sssd/ldap/nscd down), corrupted group database, or resource limits during group enumeration.

Common situations: Host joined to LDAP/AD where the group lookup backend is unreachable; /etc/group unreadable in minimal containers; nscd returning stale/failed responses.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4d572837a3ff5000. Report an issue: GitHub.