hashicorp/nomad · error

used task driver %q is not allowed in namespace %q

Error message

used task driver %q is not allowed in namespace %q

What it means

Namespaces can constrain which task drivers are allowed (namespace driver allow/deny lists). After looking up the namespace, this validator collects any task whose driver is disallowed; if exactly one disallowed driver was found, registration fails with this singular-form error naming the driver and namespace.

Source

Thrown at nomad/job_endpoint_validators.go:41

	ns, err := c.srv.State().NamespaceByName(nil, job.Namespace)
	if err != nil {
		return nil, err
	}
	if ns == nil {
		return nil, fmt.Errorf("job %q is in nonexistent namespace %q", job.ID, job.Namespace)
	}

	var disallowedDrivers []string
	for _, tg := range job.TaskGroups {
		for _, t := range tg.Tasks {
			if !taskValidateDriver(t, ns) {
				disallowedDrivers = append(disallowedDrivers, t.Driver)
			}
		}
	}
	if len(disallowedDrivers) > 0 {
		if len(disallowedDrivers) == 1 {
			return nil, fmt.Errorf(
				"used task driver %q is not allowed in namespace %q", disallowedDrivers[0], ns.Name,
			)

		} else {
			return nil, fmt.Errorf(
				"used task drivers %q are not allowed in namespace %q", disallowedDrivers, ns.Name,
			)
		}
	}

	var disallowedNetworkModes []string
	for _, tg := range job.TaskGroups {
		for _, network := range tg.Networks {
			if allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {
				disallowedNetworkModes = append(disallowedNetworkModes, network_mode)
			}
		}
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change the task's driver to one allowed in the namespace
2. Update the namespace driver policy (nomad namespace apply -allow-drivers/-deny-drivers) to permit the driver
3. Move the job to a namespace whose driver policy matches its needs

Example fix

// before
namespace "team" { driver_policy { deny = ["raw_exec"] } } // job uses raw_exec
// after
nomad namespace apply -allow-drivers=raw_exec team
// or switch the task driver to docker

// before submit
ns, _ := client.Namespaces().Info(job.Namespace, nil)
allowed := ns.DriverConfig != nil && len(ns.DriverConfig.DeniedDrivers) == 0
for _, t := range allTasks(job) {
  if !driverAllowedInNamespace(ns, t.Driver) {
    return fmt.Errorf("driver %s not allowed in %s", t.Driver, ns.Name)
  }
}

When it happens

Trigger: Registering a job where exactly one task in the entire job uses a driver not in the namespace's allowed driver list. Raised in Validate when len(disallowedDrivers) == 1.

Common situations: Team-scoped namespaces restrict drivers (e.g. only docker allowed) but a job uses exec or raw_exec; namespace driver policy updated after jobs already rely on other drivers; multi-cluster job ported to a namespace with stricter driver policy.

Related errors

• used task drivers %q are not allowed in namespace %q
• job %q is in nonexistent namespace %q
• used group network mode %q is not allowed in namespace %q
• used group network modes %q are not allowed in namespace %q
• ErrConnectRequireOneNetwork

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/7fbf18304c388220. Report an issue: GitHub.