hashicorp/nomad · error

%w: "%s"

Error message

%w: "%s"

What it means

This is the formatted wrapper "<err>: \"<label>\"" produced in VolumeMount.Validate when SELinuxLabelIsValid() fails. It wraps errVolMountInvalidSELinuxLabel with the offending SELinuxLabel string, appended to the multierror.

Source

Thrown at nomad/structs/volumes.go:339

	nv := new(VolumeMount)
	*nv = *v
	return nv
}

func (v *VolumeMount) Validate() error {
	var mErr *multierror.Error

	// Validate the task does not reference undefined volume mounts
	if v.Volume == "" {
		mErr = multierror.Append(mErr, errVolMountEmptyVol)
	}

	if !v.MountPropagationModeIsValid() {
		mErr = multierror.Append(mErr, fmt.Errorf("%w: %q", errVolMountInvalidPropagationMode, v.PropagationMode))
	}

	if !v.SELinuxLabelIsValid() {
		mErr = multierror.Append(mErr, fmt.Errorf("%w: \"%s\"", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))
	}

	return mErr.ErrorOrNil()
}

func (v *VolumeMount) MountPropagationModeIsValid() bool {
	switch v.PropagationMode {
	case "", VolumeMountPropagationPrivate, VolumeMountPropagationHostToTask, VolumeMountPropagationBidirectional:
		return true
	default:
		return false
	}
}

func (v *VolumeMount) SELinuxLabelIsValid() bool {
	switch v.SELinuxLabel {
	case "", SELinuxSharedVolume, SELinuxPrivateVolume:
		return true

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set selinux_label to "z" or "Z", or clear it entirely.
2. Use the quoted value in the error to locate and correct the bad field.
3. Verify case-sensitivity — the valid labels are single characters.

Example fix

// before
SELinuxLabel: "private"
// after
SELinuxLabel: "Z"

if !mount.SELinuxLabelIsValid() {
    return fmt.Errorf("bad SELinux label: %q", mount.SELinuxLabel)
}

func isValidSELinuxLabel(l string) bool {
    return l == "" || l == "z" || l == "Z"
}

if err := mount.Validate(); err != nil {
    if errors.Is(err, errVolMountInvalidSELinuxLabel) {
        // fix selinux_label and retry
    }
}

When it happens

Trigger: VolumeMount.Validate is called with a SELinuxLabel that is not "", "z", or "Z"; the error text reads "volume mount has an invalid SELinux label: \"<value>\"".

Common situations: Full SELinux context strings pasted into selinux_label; case errors ("Z" vs "z"); config copied from SELinux-hardened Docker setups.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• volume mount has an invalid SELinux label
• volume mount has an invalid propagation mode
• volume mount references an empty volume
• volume has unrecognized type %s
• %w: %q

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b69941daff4f396e. Report an issue: GitHub.