hashicorp/nomad · error

volume mount has an invalid SELinux label

Error message

volume mount has an invalid SELinux label

What it means

This error comes from VolumeMount.Validate when SELinuxLabel is set to a value outside the allowed set. The sentinel errVolMountInvalidSELinuxLabel is wrapped with the invalid label string. Valid labels are defined by constants such as SELinuxSharedVolume ("z") and SELinuxPrivateVolume ("Z").

Source

Thrown at nomad/structs/volumes.go:25

	"fmt"

	multierror "github.com/hashicorp/go-multierror"
)

const (
	VolumeTypeHost = "host"

	VolumeMountPropagationPrivate       = "private"
	VolumeMountPropagationHostToTask    = "host-to-task"
	VolumeMountPropagationBidirectional = "bidirectional"

	SELinuxSharedVolume  = "z"
	SELinuxPrivateVolume = "Z"
)

var (
	errVolMountInvalidPropagationMode = fmt.Errorf("volume mount has an invalid propagation mode")
	errVolMountInvalidSELinuxLabel    = fmt.Errorf("volume mount has an invalid SELinux label")
	errVolMountEmptyVol               = fmt.Errorf("volume mount references an empty volume")
)

// ClientHostVolumeConfig is used to configure access to host paths on a Nomad Client
type ClientHostVolumeConfig struct {
	Name     string `hcl:",key"`
	Path     string `hcl:"path"`
	ReadOnly bool   `hcl:"read_only"`
	// ID is set for dynamic host volumes only.
	ID string `hcl:"-"`
}

func (p *ClientHostVolumeConfig) Equal(o *ClientHostVolumeConfig) bool {
	if p == nil && o == nil {
		return true
	}
	if p == nil || o == nil {
		return false

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set selinux_label to "z" (shared) or "Z" (private), or remove it if SELinux labeling is not needed.
2. Remember the labels are case-sensitive: "Z" is private, "z" is shared.
3. Check the error suffix for the exact offending string and correct it.

Example fix

// before
selinux_label = "system_u:object_r:container_file_t:s0"
// after
selinux_label = "z"

validLabels := map[string]bool{"": true, "z": true, "Z": true}
if !validLabels[mount.SELinuxLabel] {
    return fmt.Errorf("invalid selinux_label %q", mount.SELinuxLabel)
}

func isValidSELinuxLabel(l string) bool {
    return l == "" || l == "z" || l == "Z"
}

When it happens

Trigger: Calling Validate() on a VolumeMount whose SELinuxLabel is not "", "z", or "Z" — e.g. the test value "very invalid selinux label" — after SELinuxLabelIsValid() returns false.

Common situations: Users familiar with full SELinux context strings (e.g. system_u:object_r:...) pasting them into the selinux_label field; typos like lowercase/uppercase confusion ('z' vs 'Z'); config generated by other container tooling.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• %w: "%s"
• volume mount has an invalid propagation mode
• volume mount references an empty volume
• volume has unrecognized type %s
• %w: %q

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/deeebb49d29b93da. Report an issue: GitHub.