Tencent/WeKnora · error

CPU limit cannot be negative

Error message

CPU limit cannot be negative

What it means

Range guard in ValidateConfig: fires when the effective sandbox configuration specifies a negative MaxCPU value. CPU limits are resource ceilings and must be zero-or-positive; a negative value indicates a miscomputed or malformed config and is rejected before any manager or session is created.

Source

Thrown at internal/sandbox/sandbox.go:386

	}

	switch config.Type {
	case SandboxTypeDocker, SandboxTypeCube, SandboxTypeE2B, SandboxTypeDisabled:
		// Valid types
	default:
		return errors.New("invalid sandbox type")
	}

	if config.DefaultTimeout < 0 {
		return errors.New("timeout cannot be negative")
	}

	if config.MaxMemory < 0 {
		return errors.New("memory limit cannot be negative")
	}

	if config.MaxCPU < 0 {
		return errors.New("CPU limit cannot be negative")
	}

	return nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Set MaxCPU to a positive core count or 0 for no limit.
2. Fix the calculation producing the negative value (check subtraction order and underflow).
3. Validate MaxCPU >= 0 before constructing the Manager.

Example fix

// before
cfg.MaxCPU = totalCores - reservedCores // can go negative
// after
cfg.MaxCPU = max(0, totalCores-reservedCores)

if cfg.MaxCPU < 0 {
    return fmt.Errorf("invalid sandbox config: MaxCPU=%d must be >= 0", cfg.MaxCPU)
}

if err := sandbox.ValidateConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "CPU") {
        return fmt.Errorf("fix MaxCPU (got %d)", cfg.MaxCPU)
    }
    return err
}

When it happens

Trigger: Passing a SandboxConfig with MaxCPU < 0 to NewManager or NewSessionBoundManager, e.g. a negative CPU quota from a config file or an arithmetic error when computing core budgets.

Common situations: Computing reserved vs. total cores and subtracting in the wrong order; a stray minus sign in a limits config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid sandbox type
• timeout cannot be negative
• memory limit cannot be negative
• E2B timeout must be at least one second
• sandbox binding requires tenant and session

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/fa7fc16bf9217927. Report an issue: GitHub.