When running on a Kerberos-enabled Hadoop system, YARN may refuse user actian because it has by default an ID of 300, which is below the usual minimum allowed ID for Hadoop users. In this case, user actian should be added to the "allowed.system.users" parameter in container-executor.cfg on all nodes.