hashicorp/nomad · error

unable to start validator: %w

Error message

unable to start validator: %w

What it means

SetConfig constructs a userID validator from DeniedHostUids/DeniedHostGids when none exists yet, and wraps any validator construction failure with this error. It prevents the raw_exec driver from running with a broken/bad user-ID allowlist validator.

Source

Thrown at drivers/rawexec/driver.go:248

}

func (d *Driver) ConfigSchema() (*hclspec.Spec, error) {
	return configSpec, nil
}

func (d *Driver) SetConfig(cfg *base.Config) error {
	var config Config

	if len(cfg.PluginConfig) != 0 {
		if err := base.MsgPackDecode(cfg.PluginConfig, &config); err != nil {
			return err
		}
	}

	if d.userIDValidator == nil {
		idValidator, err := validators.NewValidator(d.logger, config.DeniedHostUids, config.DeniedHostGids)
		if err != nil {
			return fmt.Errorf("unable to start validator: %w", err)
		}

		d.userIDValidator = idValidator
	}

	d.config = &config

	if cfg.AgentConfig != nil {
		d.nomadConfig = cfg.AgentConfig.Driver
		d.compute = cfg.AgentConfig.Compute()
	}

	return nil
}

func (d *Driver) TaskConfigSchema() (*hclspec.Spec, error) {
	return taskConfigSpec, nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Fix the DeniedHostUids / DeniedHostGids values in the client plugin config (must be valid numeric ID lists)
2. Inspect the wrapped %w cause in the error/client logs for the exact parse failure
3. Restart the Nomad client after correcting the config so SetConfig reruns cleanly

Example fix

// before (client.hcl)
plugin "raw_exec" {
  config {
    denied_host_uids = "root, admin" # invalid: non-numeric
  }
}
// after
plugin "raw_exec" {
  config {
    denied_host_uids = "0,1"
    denied_host_gids = "0,1"
  }
}

// pre-validate denied UID/GID lists before SetConfig
for _, s := range strings.Split(deniedUids, ",") {
    if _, err := strconv.Atoi(strings.TrimSpace(s)); err != nil {
        return fmt.Errorf("invalid denied_host_uid %q", s)
    }
}

if err := drv.SetConfig(cfg); err != nil && strings.Contains(err.Error(), "unable to start validator") {
    // inspect wrapped cause; fix denied_host_uids/gids config
}

When it happens

Trigger: Driver SetConfig called with a userIDValidator not yet initialized and validators.NewValidator failing on invalid DeniedHostUids/DeniedHostGids config values.

Common situations: Client config with malformed denied UID/GID lists (non-numeric values, parse failures); plugin (re)configuration after agent reload where the validator must be recreated.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• raw_exec is disabled
• handle cannot be nil
• plugin not found
• wait config is nil or empty
• wait config is empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2a7a9fa226817cea. Report an issue: GitHub.