hashicorp/nomad · error

validator: %w

Error message

validator:  %w

What it means

After UID checks, HasValidIDs fetches the user's supplementary group IDs via getGroupsID. This error means that enumeration failed — cgo-free user lookups or /etc/group parsing could not produce the group list. It wraps the low-level error with the same "validator:" prefix.

Source

Thrown at drivers/shared/validators/validators.go:87

func (v *Validator) HasValidIDs(userName string) error {
	user, err := users.Lookup(userName)
	if err != nil {
		return fmt.Errorf("failed to identify user %q: %w", userName, err)
	}

	uid, err := getUserID(user)
	if err != nil {
		return fmt.Errorf("validator: %w", err)
	}

	// check uids
	if v.deniedUIDs.Contains(uid) {
		return fmt.Errorf("running as uid %d is disallowed", uid)
	}

	gids, err := getGroupsID(user)
	if err != nil {
		return fmt.Errorf("validator:  %w", err)
	}

	// check gids
	for _, gid := range gids {
		if v.deniedGIDs.Contains(gid) {
			return fmt.Errorf("running as gid %d is disallowed", gid)
		}
	}

	return nil
}

// validateIDRange is used to ensure that the configuration for ID ranges is valid
// by checking the syntax and bounds.
func validateIDRange(rangeType string, deniedRanges string) error {

	parts := strings.Split(deniedRanges, ",")

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify group enumeration works on the host: id -G <user> and getent group
2. Fix /etc/group permissions/format or the NSS/SSSD configuration on the client
3. If using domain users, ensure the LDAP/SSSD provider is reachable
4. Rebuild with cgo enabled if a static build cannot enumerate groups on your platform

Example fix

// before: unreadable group database on client
// -rw------- root root /etc/group
// after: restore standard permissions
// -rw-r--r-- root root /etc/group

// ensure group enumeration works before submitting tasks
if _, err := u.GroupIds(); err != nil {
    return fmt.Errorf("cannot enumerate groups for %q: %w", userName, err)
}

gids, err := getGroupsID(user)
if err != nil {
    // treat as host configuration problem: check /etc/group and NSS before retrying
    return fmt.Errorf("validator: %w", err)
}

When it happens

Trigger: users.Lookup returned a valid user, but the group lookup fails: /etc/group unreadable or corrupt, NSS group source (LDAP/SSSD) unavailable, or the group membership enumeration errors during task validation.

Common situations: Broken permissions on /etc/group; SSSD/LDAP outage for domain users; malformed group database entries; CGO_ENABLED=0 builds where group enumeration backends are limited.

Related errors

• failed to get current user: %w
• failed to identify user %q: %w
• validator: %w
• running as gid %d is disallowed
• missing secret ID

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2232e88cc1acc647. Report an issue: GitHub.