hashicorp/nomad · error

validator: %w

Error message

validator: %w

What it means

After resolving the user, HasValidIDs extracts the numeric UID via getUserID. This error means the passwd entry's UID field could not be parsed into a number (strconv.Atoi failure) — the user record on the host is malformed. The generic "validator:" prefix wraps the low-level parse error.

Source

Thrown at drivers/shared/validators/validators.go:77

		deniedUIDs: idset.Parse[UserID](deniedHostUIDs),
		deniedGIDs: idset.Parse[GroupID](deniedHostGIDs),
		logger:     valLogger,
	}

	return v, nil
}

// HasValidIDs is used when running a task to ensure the
// given user is in the ID range defined in the task config
func (v *Validator) HasValidIDs(userName string) error {
	user, err := users.Lookup(userName)
	if err != nil {
		return fmt.Errorf("failed to identify user %q: %w", userName, err)
	}

	uid, err := getUserID(user)
	if err != nil {
		return fmt.Errorf("validator: %w", err)
	}

	// check uids
	if v.deniedUIDs.Contains(uid) {
		return fmt.Errorf("running as uid %d is disallowed", uid)
	}

	gids, err := getGroupsID(user)
	if err != nil {
		return fmt.Errorf("validator:  %w", err)
	}

	// check gids
	for _, gid := range gids {
		if v.deniedGIDs.Contains(gid) {
			return fmt.Errorf("running as gid %d is disallowed", gid)
		}
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the user's passwd entry (getent passwd <user>) and fix a non-numeric UID field
2. Delete and recreate the user with a valid numeric UID
3. Audit provisioning tools/templates that generate /etc/passwd for format errors
4. Check alternate NSS sources (LDAP) are returning RFC-compliant records

Example fix

// before (corrupt /etc/passwd entry)
appuser:x:abc:1500::/home/appuser:/bin/bash
// after
appuser:x:1500:1500::/home/appuser:/bin/bash

u, err := user.Lookup(userName)
if err != nil { return err }
if _, err := strconv.Atoi(u.Uid); err != nil {
    return fmt.Errorf("user %q has malformed UID %q in passwd database", userName, u.Uid)
}

When it happens

Trigger: users.Lookup returned a user whose Uid string is non-numeric (corrupt or hand-edited /etc/passwd, or unusual NSS backends returning malformed records), during task validation on the client.

Common situations: Manually edited /etc/passwd with a non-numeric UID field; broken custom NSS modules; containerized/chroot environments with mangled passwd files; SELinux or provisioning tools writing invalid entries.

Related errors

• failed to identify user %q: %w
• failed to get current user: %w
• running as uid %d is disallowed
• validator: %w
• invalid user ID %q: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/50a15a8747357bbf. Report an issue: GitHub.