hashicorp/nomad · error

unable to start validator: %w

Error message

unable to start validator: %w

What it means

SetConfig lazily creates a uid/gid validator via validators.NewValidator using the configured DeniedHostUids/DeniedHostGids. If that constructor fails (e.g. malformed uid/gid values that cannot be parsed), SetConfig aborts with "unable to start validator: %w" wrapping the cause.

Source

Thrown at drivers/exec/driver.go:322

func (d *Driver) SetConfig(cfg *base.Config) error {
	// unpack, validate, and set agent plugin config
	var config Config

	if len(cfg.PluginConfig) != 0 {
		if err := base.MsgPackDecode(cfg.PluginConfig, &config); err != nil {
			return err
		}
	}

	if err := config.validate(); err != nil {
		return err
	}

	if d.userIDValidator == nil {
		idValidator, err := validators.NewValidator(d.logger, config.DeniedHostUids, config.DeniedHostGids)
		if err != nil {
			return fmt.Errorf("unable to start validator: %w", err)
		}

		d.userIDValidator = idValidator
	}

	d.config = config

	if cfg != nil && cfg.AgentConfig != nil {
		d.nomadConfig = cfg.AgentConfig.Driver
		d.compute = cfg.AgentConfig.Compute()
	}
	return nil
}

func (d *Driver) TaskConfigSchema() (*hclspec.Spec, error) {
	return taskConfigSpec, nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the wrapped cause and fix denied_host_uids/denied_host_gids values in the client plugin config
2. Use numeric uids/gids or valid ranges only
3. Remove the options to disable host uid/gid deny lists

Example fix

// before
config {
  denied_host_uids = ["root", "1000-abc"]
}
// after
config {
  denied_host_uids = ["1000-1100"]
}

for _, v := range cfg.DeniedHostUids {
  if _, err := strconv.ParseUint(v, 10, 32); err != nil {
    return fmt.Errorf("bad denied_host_uids entry %q", v)
  }
}

if err := driver.SetConfig(cfg); err != nil {
  var wrapped error
  if errors.As(err, &wrapped) && strings.Contains(err.Error(), "unable to start validator") {
    log.Printf("fix denied_host_uids/gids config: %v", err)
  }
  return err
}

When it happens

Trigger: Driver plugin startup when denied_host_uids or denied_host_gids contains entries that NewValidator cannot parse (non-numeric strings, malformed ranges), or the validator's internal init fails.

Common situations: HCL plugin config with badly formatted uid/gid lists; mistyped ranges; config templating producing empty/garbage values.

Related errors

• default_pid_mode must be %q or %q, got %q
• default_ipc_mode must be %q or %q, got %q
• allow_caps configured with capabilities not supported by sys
• no CNI network config found
• dynamic workload users disabled

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9d21729a58ffbe12. Report an issue: GitHub.