used group network mode %q is not allowed in namespace %q

Error message

used group network mode %q is not allowed in namespace %q

What it means

Namespaces can also restrict group network modes (namespace network allow/deny lists). This validator collects each task group's network mode that is disallowed; when exactly one is found, registration fails with this singular error naming the network mode and namespace.

Source

Thrown at nomad/job_endpoint_validators.go:62

		} else {
			return nil, fmt.Errorf(
				"used task drivers %q are not allowed in namespace %q", disallowedDrivers, ns.Name,
			)
		}
	}

	var disallowedNetworkModes []string
	for _, tg := range job.TaskGroups {
		for _, network := range tg.Networks {
			if allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {
				disallowedNetworkModes = append(disallowedNetworkModes, network_mode)
			}
		}
	}
	if len(disallowedNetworkModes) > 0 {
		if len(disallowedNetworkModes) == 1 {
			return nil, fmt.Errorf(
				"used group network mode %q is not allowed in namespace %q", disallowedNetworkModes[0], ns.Name,
			)

		} else {
			return nil, fmt.Errorf(
				"used group network modes %q are not allowed in namespace %q", disallowedNetworkModes, ns.Name,
			)
		}
	}

	return nil, nil
}

func taskValidateNetworkMode(network *structs.NetworkResource, ns *structs.Namespace) (bool, string) {
	network_mode := "host"
	if len(network.Mode) > 0 {
		network_mode = network.Mode
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

Change the group network block's mode to one allowed by the namespace
Update the namespace network policy (nomad namespace apply -allow-network/-deny-network)
Move the job to a namespace permitting the required network mode

Example fix

// before
network { mode = "host" } // namespace allows only bridge
// after
network { mode = "bridge" }
// or: nomad namespace apply -allow-network=host team

Defensive patterns

Strategy: validation

Validate before calling

// before submit
ns, _ := client.Namespaces().Info(job.Namespace, nil)
for _, tg := range job.TaskGroups {
  for _, n := range tg.Networks {
    if !networkModeAllowedInNamespace(ns, n.Mode) {
      return fmt.Errorf("network mode %s not allowed in %s", n.Mode, ns.Name)
    }
  }
}

Prevention

Confirm namespace network policy before choosing bridge/host/cni modes
Lint network blocks against namespace allow-lists in CI
Remember service mesh jobs typically need bridge mode allowed

When it happens

Trigger: Registering a job where exactly one group network mode (e.g. "bridge", "host", "cni/foo") is not permitted by the namespace's network policy. Raised in Validate when len(disallowedNetworkModes) == 1.

Common situations: namespace restricted to bridge networking but a job uses host networking; CNI-based modes blocked in a namespace on clusters without CNI configured; service-mesh (consul connect, mode=bridge) jobs deployed into namespaces disallowing bridge.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1cdad52215b2c5e1. Report an issue: GitHub.