Tencent/WeKnora · error

sandbox: invalid cube DNS server %q (need an IP address)

Error message

sandbox: invalid cube DNS server %q (need an IP address)

What it means

NormalizeCubeDNSServers sanitizes the cube sandbox DNS server list: each entry must parse as an IP address via net.ParseIP. Non-IP strings (hostnames, malformed addresses) abort normalization with this error rather than being silently passed to the Cube SDK.

Source

Thrown at internal/sandbox/cube_dns.go:25

)

// NormalizeCubeDNSServers trims, drops empties, rejects non-IP values, and
// de-duplicates. Cube's template `dns` field is a list of nameserver IPs —
// hostnames are not accepted. An empty result means "leave Cubelet's default".
func NormalizeCubeDNSServers(raw []string) ([]string, error) {
	if len(raw) == 0 {
		return nil, nil
	}
	out := make([]string, 0, len(raw))
	seen := make(map[string]struct{}, len(raw))
	for _, item := range raw {
		ip := strings.TrimSpace(item)
		if ip == "" {
			continue
		}
		parsed := net.ParseIP(ip)
		if parsed == nil {
			return nil, fmt.Errorf("sandbox: invalid cube DNS server %q (need an IP address)", item)
		}
		canonical := parsed.String()
		if _, dup := seen[canonical]; dup {
			continue
		}
		seen[canonical] = struct{}{}
		out = append(out, canonical)
	}
	if len(out) == 0 {
		return nil, nil
	}
	return out, nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Replace each entry with a literal IP address, e.g. "8.8.8.8", "1.1.1.1", or an IPv6 literal like "2001:4860:4860::8888"
2. Run net.ParseIP on the value locally to confirm it parses before adding it to config
3. Remove CIDR suffixes and hostnames from the DNS server list — only bare IPs are valid
4. Empty and whitespace-only entries are skipped, not errors; check that the offending string has no hidden characters

Example fix

// before
DNSServers: []string{"dns.corp.internal", "8.8.8.8"}
// after
DNSServers: []string{"10.0.0.53", "8.8.8.8"} // literal IPs only

for _, s := range cfg.Cube.DNSServers {
    if net.ParseIP(strings.TrimSpace(s)) == nil {
        return fmt.Errorf("DNS server %q is not a literal IP", s)
    }
}

func allDNSAreIPs(servers []string) bool {
    for _, s := range servers {
        if t := strings.TrimSpace(t := s); t != "" && net.ParseIP(t) == nil { return false }
    }
    return true
}

servers, err := sandbox.NormalizeCubeDNSServers(raw)
if err != nil {
    if strings.Contains(err.Error(), "invalid cube DNS server") { /* drop/fix the offending entry */ }
    return err
}

When it happens

Trigger: Configuring cube DNS servers with a hostname like "dns.internal" or "8.8.8.8/32" or a typo'd IP ("8.8.8."), then calling ResolveEffectiveConfig / SanitizeSandboxConfig / standardTemplateSpec, which invoke NormalizeCubeDNSServers.

Common situations: Putting a DNS hostname where an IP is required; copy-pasting CIDR notation into a server list; trailing dots or stray whitespace is trimmed but a wrong digit still fails; IPv6 entries must be literal addresses too.

Related errors

• invalid sandbox type
• timeout cannot be negative
• memory limit cannot be negative
• CPU limit cannot be negative
• sandbox: config is missing required fields: %s backend requi

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/2d6daeb7032292d4. Report an issue: GitHub.