Bumping `resources.secrets` leads to docker error

[ygersie]

Nomad version

1.10.8+ent

Issue

Create a job with:

            resources {
                cpu = 100
                memory = 128
                secrets = 6
            }

Result: allocation fails to start with docker error:

Time                       Type             Description
2026-04-09T10:32:30+02:00  Alloc Unhealthy  Unhealthy because of failed task
2026-04-09T10:32:26+02:00  Not Restarting   Error was unrecoverable
2026-04-09T10:32:26+02:00  Driver Failure   failed to create container: Error response from daemon: Minimum memory limit can not be less than memory reservation limit, see usage
2026-04-09T10:32:25+02:00  Task Setup       Building Task Directory
2026-04-09T10:32:19+02:00  Received         Task received by client

Setting memory_max to the same value as memory fixes the issue.

[jrasell]

Hi @ygersie and thanks for raising this issue. I've not been able to reproduce this on my workstation; do you have any more details that might help track this down? Thanks.

I used this minimal job spec which I tested both deploying straight away and deploying without the secrets entry, then adding this in.

job "example" {
  group "cache" {
    task "redis" {
      driver = "docker"
      config {
        image = "redis:7"
      }
      resources {
        cpu     = 100
        memory  = 128
        secrets = 6
      }
    }
  }
}

The Nomad version used for both the server and client:

$ nomad version
Nomad v1.10.8+ent
BuildDate 2026-02-11T18:50:38Z
Revision f63050fcf2c73afe2b13fe8c2bb8ebc87765db23

The Docker information on the client host:

$ docker version
Client: Docker Engine - Community
 Version:           29.4.0
 API version:       1.54
 Go version:        go1.26.1
 Git commit:        9d7ad9f
 Built:             Tue Apr  7 08:36:33 2026
 OS/Arch:           linux/arm64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.4.0
  API version:      1.54 (minimum version 1.40)
  Go version:       go1.26.1
  Git commit:       daa0cb7
  Built:            Tue Apr  7 08:36:33 2026
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.2.0
  GitCommit:        1c4457e00facac03ce1d75f7b6777a7a851e5c41
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[ygersie]

Hey @jrasell we're running

# docker info
Client:
 Version:    28.3.3
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.24.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx

Server:
 Containers: 16
  Running: 16
  Paused: 0
  Stopped: 0
 Images: 8
 Server Version: 28.3.3
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2```

[jrasell]

Thanks @ygersie. It looks like this is specific to Docker version running, so I'll get this onto our backlog to look into.