{"record":{"id":"60c3c1faa7bd105c","repo":"hashicorp/nomad","slug":"secretsmb-value-d-cannot-be-negative","errorCode":null,"errorMessage":"SecretsMB value (%d) cannot be negative","messagePattern":"SecretsMB value \\((.+?)\\) cannot be negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":2473,"sourceCode":"\t\t}\n\t}\n\n\t// Ensure the numa block is valid\n\tif err := r.NUMA.Validate(); err != nil {\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\t// Ensure memory_max is greater than memory, unless it is set to 0 or -1 which\n\t// are both sentinel values\n\tif (r.MemoryMaxMB != 0 && r.MemoryMaxMB != MemoryNoLimit) && r.MemoryMaxMB < r.MemoryMB {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"MemoryMaxMB value (%d) should be larger than MemoryMB value (%d)\", r.MemoryMaxMB, r.MemoryMB))\n\t}\n\n\tif r.SecretsMB > r.MemoryMB {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"SecretsMB value (%d) cannot be larger than MemoryMB value (%d)\", r.SecretsMB, r.MemoryMB))\n\t}\n\tif r.SecretsMB < 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"SecretsMB value (%d) cannot be negative\", r.SecretsMB))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// Merge merges this resource with another resource.\n// COMPAT(0.10): Remove in 0.10\nfunc (r *Resources) Merge(other *Resources) {\n\tif other.CPU != 0 {\n\t\tr.CPU = other.CPU\n\t}\n\tif other.Cores != 0 {\n\t\tr.Cores = other.Cores\n\t}\n\tif other.MemoryMB != 0 {\n\t\tr.MemoryMB = other.MemoryMB\n\t}\n\tif other.MemoryMaxMB != 0 {","sourceCodeStart":2455,"sourceCodeEnd":2491,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L2455-L2491","documentation":"Resources.Validate() rejects a negative SecretsMB. Reserved secret memory is a byte count and only non-negative values are meaningful; negative values would corrupt accounting in the scheduler and driver. -1 is not accepted here as a sentinel (unlike memory_max).","triggerScenarios":"Submitting a job whose task Resources has SecretsMB < 0, e.g. secrets_mb = -1.","commonSituations":"Using -1 to mean 'unset' as one might with other memory fields; arithmetic producing negative values when templating resources; typo of a leading minus sign.","solutions":["Set SecretsMB (secrets_mb) to 0 or a positive integer","Remove secrets_mb from the resources block entirely if unused"],"exampleFix":"// before\nresources {\n  secrets_mb = -1\n}\n// after\nresources {\n  secrets_mb = 0\n}","handlingStrategy":"validation","validationCode":"if r.SecretsMB < 0 {\n    return fmt.Errorf(\"secrets_mb (%d) must be >= 0\", r.SecretsMB)\n}","typeGuard":"func nonNegative(n int) bool { return n >= 0 }","tryCatchPattern":null,"preventionTips":["Don't use -1 as an unset sentinel for secrets_mb; omit the field instead","Clamp computed values with max(0, x) when templating resources"],"tags":["nomad","resources","validation"],"backgroundTag":"resource-spec-validation","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}