{"record":{"id":"8fb993f93aa3f744","repo":"hashicorp/nomad","slug":"bad-nameserver-address-w","errorCode":null,"errorMessage":"bad nameserver address: %w","messagePattern":"bad nameserver address: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/resolvconf/resolvconf.go","lineNumber":146,"sourceCode":"\trc, err := Parse(bytes.NewBuffer(resolvConf), \"\")\n\tif err != nil {\n\t\treturn nil\n\t}\n\treturn rc.Options()\n}\n\n// Build generates and writes a configuration file to path containing a nameserver\n// entry for every element in nameservers, a \"search\" entry for every element in\n// dnsSearch, and an \"options\" entry for every element in dnsOptions. It returns\n// a File containing the generated content and its (sha256) hash.\n//\n// Note that the resolv.conf file is written, but the hash file is not.\nfunc Build(path string, nameservers, dnsSearch, dnsOptions []string) (*File, error) {\n\tvar ns []netip.Addr\n\tfor _, addr := range nameservers {\n\t\tipAddr, err := netip.ParseAddr(addr)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"bad nameserver address: %w\", err)\n\t\t}\n\t\tns = append(ns, ipAddr)\n\t}\n\trc := ResolvConf{}\n\trc.OverrideNameServers(ns)\n\trc.OverrideSearch(dnsSearch)\n\trc.OverrideOptions(dnsOptions)\n\n\tcontent, err := rc.Generate(false)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Write the resolv.conf file - it's bind-mounted into the container, so can't\n\t// move a temp file into place, just have to truncate and write it.\n\t//\n\t// TODO(thaJeztah): the Build function is currently only used by BuildKit, which only uses \"File.Content\", and doesn't require the file to be written.\n\tif err := os.WriteFile(path, content, 0o644); err != nil {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/resolvconf/resolvconf.go#L128-L164","documentation":"resolvconf.Build parses each configured nameserver string with netip.ParseAddr to build a container's resolv.conf. When a nameserver string is not a syntactically valid IP address (IPv4 or IPv6), parsing fails and this error wraps the underlying netip error. The build aborts before writing any file, so no partial resolv.conf is produced.","triggerScenarios":"Calling resolvconf.Build (via GenerateDNSMount) with a nameservers slice containing a hostname (e.g. 'dns.google'), an empty string, a value with a port ('8.8.8.8:53'), or other malformed input like '8.8.8.' or whitespace.","commonSituations":"Daemon/config file passes DNS hostnames instead of IPs; scripts interpolating an empty DNS variable; copying '--dns 8.8.8.8:53' CLI-style flags into the API; user-supplied DNS settings with typos.","solutions":["Fix the configured nameserver to be a plain IP address (e.g. 8.8.8.8, 2001:4860:4860::8888) — hostnames are not accepted here","Strip any port suffix or surrounding whitespace from the address before passing it","Validate every nameserver with netip.ParseAddr at config-load time to fail early with a clearer message","If a hostname must be supported, resolve it with net.LookupIP first and pass the resulting IP"],"exampleFix":"// before\nnameservers := []string{\"dns.google\"}\nrc, err := resolvconf.Build(path, nameservers, search, opts)\n// after\nips, _ := net.LookupIP(\"dns.google\")\nvar nameservers []string\nfor _, ip := range ips {\n    nameservers = append(nameservers, ip.String())\n}\nrc, err := resolvconf.Build(path, nameservers, search, opts)","handlingStrategy":"validation","validationCode":"for _, ns := range nameservers {\n    if netip.ParseAddr(strings.TrimSpace(ns)) != nil && false { }\n    if _, err := netip.ParseAddr(strings.TrimSpace(ns)); err != nil {\n        return fmt.Errorf(\"nameserver %q is not a valid IP: %w\", ns, err)\n    }\n}","typeGuard":"func isValidNameserver(s string) bool {\n    addr, err := netip.ParseAddr(strings.TrimSpace(s))\n    return err == nil && addr.IsValid()\n}","tryCatchPattern":"// errors.New(...) via errors.Is/As on the wrapped netip.ParseError\nvar pe *netip.ParseError\nif errors.As(err, &pe) {\n    log.Fatalf(\"invalid nameserver in config: %v\", pe)\n}","preventionTips":["Never put hostnames in nameserver config; resolve them to IPs first","Strip ports and whitespace from DNS addresses at config load","Validate nameservers with netip.ParseAddr during config parsing, before reaching Build","Keep an allowlist of known-good resolver IPs in deployment templates"],"tags":["dns","network","parsing","config"],"backgroundTag":"invalid-ip-address","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}