anomalyco/sst · error · VisibleError

You must provide a "container" name in each rule when there

Error message

You must provide a "container" name in each rule when there is more than one container in Service "${name}".

What it means

With a single container SST can infer the target container, but with multiple containers each ALB rule must name which container receives the traffic. Ambiguity would otherwise route traffic unpredictably, so the constructor rejects rules missing a container name.

Source

Thrown at platform/src/components/aws/service.ts:2628

    function createAlbTargetsAndEntries(
      attachment: NonNullable<typeof albAttachment>,
    ) {
      const rules = attachment.rules;
      const health = attachment.health ?? {};

      if (rules.length === 0) {
        throw new VisibleError(
          `You must provide at least one rule in "loadBalancer.rules" when using an external ALB in Service "${name}".`,
        );
      }

      // Validate container names (no resources created here)
      containers.apply((ctrs) => {
        const containerNames = new Set(ctrs.map((c) => c.name));
        if (ctrs.length > 1) {
          for (const rule of rules) {
            if (!rule.container) {
              throw new VisibleError(
                `You must provide a "container" name in each rule when there is more than one container in Service "${name}".`,
              );
            }
          }
        }
        for (const rule of rules) {
          const cn = rule.container ?? ctrs[0].name;
          if (!containerNames.has(cn)) {
            throw new VisibleError(
              `Container "${cn}" in "loadBalancer.rules" does not match any container in Service "${name}". Available: ${[...containerNames].join(", ")}.`,
            );
          }
        }
      });

      // Create target groups in a plain loop (no apply)
      const targets: Record<string, lb.TargetGroup> = {};
      const rawEntries: {

View on GitHub (pinned to a0bd20f762)

Solutions

Add container: "<name>" to every rule, matching the container's name
Reduce to a single container if the extra one isn't needed
Ensure sidecars are defined without LB rules and only the public-facing container is referenced

Example fix

// before
rules: [{ listen: "443/https", conditions: { path: "/*" } }]
// after
rules: [{ listen: "443/https", container: "app", conditions: { path: "/*" } }]

Defensive patterns

Strategy: validation

Validate before calling

if (config.containers.length > 1)
  for (const r of attachment.rules)
    if (!r.container) throw new Error(`rule for ${r.listen} must specify container`);

Type guard

const ruleHasContainer = (r: { container?: string }) => typeof r.container === "string" && r.container.length > 0;

Try / catch

null

Prevention

When adding a sidecar container, audit existing LB rules and name the target container
Always specify container explicitly, even with one container
Keep container names in a shared constant module

When it happens

Trigger: A Service with two or more containers plus an external ALB attachment where one or more rules omit the container field.

Common situations: Adding a sidecar (e.g. envoy, datadog agent) to an existing single-container service and forgetting to update the rules; copy-pasting rules from a single-container example.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/cc249f6c96572e10. Report an issue: GitHub.