hashicorp/nomad · error

used task drivers %q are not allowed in namespace %q

Error message

used task drivers %q are not allowed in namespace %q

What it means

Same validation as the singular case, but triggered when two or more tasks use disallowed drivers. The plural-form message includes the full list of disallowed drivers (Go %q of a []string) and the namespace name, so the operator can fix all offending tasks at once.

Source

Thrown at nomad/job_endpoint_validators.go:46

		return nil, fmt.Errorf("job %q is in nonexistent namespace %q", job.ID, job.Namespace)
	}

	var disallowedDrivers []string
	for _, tg := range job.TaskGroups {
		for _, t := range tg.Tasks {
			if !taskValidateDriver(t, ns) {
				disallowedDrivers = append(disallowedDrivers, t.Driver)
			}
		}
	}
	if len(disallowedDrivers) > 0 {
		if len(disallowedDrivers) == 1 {
			return nil, fmt.Errorf(
				"used task driver %q is not allowed in namespace %q", disallowedDrivers[0], ns.Name,
			)

		} else {
			return nil, fmt.Errorf(
				"used task drivers %q are not allowed in namespace %q", disallowedDrivers, ns.Name,
			)
		}
	}

	var disallowedNetworkModes []string
	for _, tg := range job.TaskGroups {
		for _, network := range tg.Networks {
			if allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {
				disallowedNetworkModes = append(disallowedNetworkModes, network_mode)
			}
		}
	}
	if len(disallowedNetworkModes) > 0 {
		if len(disallowedNetworkModes) == 1 {
			return nil, fmt.Errorf(
				"used group network mode %q is not allowed in namespace %q", disallowedNetworkModes[0], ns.Name,
			)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change every listed task's driver to an allowed driver
2. Update the namespace driver policy to allow the listed drivers
3. Split the job across namespaces whose policies match each driver

Example fix

// before
// namespace allows [docker]; tasks use exec and qemu
// after
nomad namespace apply -allow-drivers=docker,exec,qemu team
// or rewrite tasks to use docker only

// before submit
ns, _ := client.Namespaces().Info(job.Namespace, nil)
var bad []string
for _, t := range allTasks(job) {
  if !driverAllowedInNamespace(ns, t.Driver) { bad = append(bad, t.Driver) }
}
if len(bad) > 0 { return fmt.Errorf("disallowed drivers: %v", bad) }

When it happens

Trigger: Registering a job where 2+ tasks use drivers not allowed by the namespace driver policy. Raised in Validate when len(disallowedDrivers) > 1.

Common situations: Multi-task-group jobs (e.g. docker + qemu + exec) deployed into a namespace allowing only a subset; namespace policy tightened retroactively; batch-converted job files using several restricted drivers.

Related errors

• used task driver %q is not allowed in namespace %q
• job %q is in nonexistent namespace %q
• used group network mode %q is not allowed in namespace %q
• used group network modes %q are not allowed in namespace %q
• ErrConnectRequireOneNetwork

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/8a583f2082206bd2. Report an issue: GitHub.