{"record":{"id":"2d3298079790b69a","repo":"hashicorp/nomad","slug":"secretsmb-value-d-cannot-be-larger-than-memorym","errorCode":null,"errorMessage":"SecretsMB value (%d) cannot be larger than MemoryMB value (%d)","messagePattern":"SecretsMB value \\((.+?)\\) cannot be larger than MemoryMB value \\((.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":2470,"sourceCode":"\t\t\tif !devices.Contains(numaDevice) {\n\t\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"numa device %q not requested as task resource\", numaDevice))\n\t\t\t}\n\t\t}\n\t}\n\n\t// Ensure the numa block is valid\n\tif err := r.NUMA.Validate(); err != nil {\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\t// Ensure memory_max is greater than memory, unless it is set to 0 or -1 which\n\t// are both sentinel values\n\tif (r.MemoryMaxMB != 0 && r.MemoryMaxMB != MemoryNoLimit) && r.MemoryMaxMB < r.MemoryMB {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"MemoryMaxMB value (%d) should be larger than MemoryMB value (%d)\", r.MemoryMaxMB, r.MemoryMB))\n\t}\n\n\tif r.SecretsMB > r.MemoryMB {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"SecretsMB value (%d) cannot be larger than MemoryMB value (%d)\", r.SecretsMB, r.MemoryMB))\n\t}\n\tif r.SecretsMB < 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"SecretsMB value (%d) cannot be negative\", r.SecretsMB))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// Merge merges this resource with another resource.\n// COMPAT(0.10): Remove in 0.10\nfunc (r *Resources) Merge(other *Resources) {\n\tif other.CPU != 0 {\n\t\tr.CPU = other.CPU\n\t}\n\tif other.Cores != 0 {\n\t\tr.Cores = other.Cores\n\t}\n\tif other.MemoryMB != 0 {","sourceCodeStart":2452,"sourceCodeEnd":2488,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L2452-L2488","documentation":"Resources.Validate() enforces that SecretsMB (reserved secret memory) never exceeds the task's total MemoryMB. SecretsMB carves a slice out of the task's memory for secret material, so it cannot be larger than the whole allocation. The value is accumulated into the multierror returned from job validation.","triggerScenarios":"Submitting a job where task Resources.SecretsMB > Resources.MemoryMB, e.g. secrets_mb = 256 with memory = 128.","commonSituations":"Misunderstanding secrets_mb as a standalone pool rather than a sub-allocation of memory; scaling memory down after setting secrets_mb; copy-pasting resource blocks between tasks with different memory sizes.","solutions":["Lower SecretsMB (secrets_mb) so it is <= MemoryMB","Increase MemoryMB so it is >= SecretsMB","Remove secrets_mb if the task does not need reserved secret memory"],"exampleFix":"// before\nresources {\n  memory     = 128\n  secrets_mb = 256\n}\n// after\nresources {\n  memory     = 512\n  secrets_mb = 256\n}","handlingStrategy":"validation","validationCode":"if r.SecretsMB > r.MemoryMB {\n    return fmt.Errorf(\"secrets_mb (%d) must be <= memory (%d)\", r.SecretsMB, r.MemoryMB)\n}","typeGuard":"func validSecretsMB(mem, secrets int) bool { return secrets >= 0 && secrets <= mem }","tryCatchPattern":null,"preventionTips":["Treat secrets_mb as a subset of memory, not an additional pool","Recompute secrets_mb whenever you scale memory down","Lint job specs to assert secrets_mb <= memory"],"tags":["nomad","resources","validation","memory"],"backgroundTag":"resource-spec-validation","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}