{"record":{"id":"a48a6294541a35bb","repo":"hashicorp/nomad","slug":"dynamic-user-max-must-not-be-negative","errorCode":null,"errorMessage":"dynamic_user_max must not be negative","messagePattern":"dynamic_user_max must not be negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/config/users.go","lineNumber":68,"sourceCode":"\tif u == nil || o == nil {\n\t\treturn u == o\n\t}\n\tswitch {\n\tcase !pointer.Eq(u.MinDynamicUser, o.MinDynamicUser):\n\t\treturn false\n\tcase !pointer.Eq(u.MaxDynamicUser, o.MaxDynamicUser):\n\t\treturn false\n\tdefault:\n\t\treturn true\n\t}\n}\n\nvar (\n\terrUsersUnset            = errors.New(\"users must not be nil\")\n\terrDynamicUserMinUnset   = errors.New(\"dynamic_user_min must be set\")\n\terrDynamicUserMinInvalid = errors.New(\"dynamic_user_min must not be negative\")\n\terrDynamicUserMaxUnset   = errors.New(\"dynamic_user_max must be set\")\n\terrDynamicUserMaxInvalid = errors.New(\"dynamic_user_max must not be negative\")\n)\n\n// Validate whether UsersConfig is valid.\n//\n// Note that -1 is a valid value for min/max dynamic users, as this is used\n// to indicate the dynamic workload users feature should be disabled.\nfunc (u *UsersConfig) Validate() error {\n\tif u == nil {\n\t\treturn errUsersUnset\n\t}\n\tif u.MinDynamicUser == nil {\n\t\treturn errDynamicUserMinUnset\n\t}\n\tif *u.MinDynamicUser < -1 {\n\t\treturn errDynamicUserMinInvalid\n\t}\n\tif u.MaxDynamicUser == nil {\n\t\treturn errDynamicUserMaxUnset","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/config/users.go#L50-L86","documentation":"Users config validation sentinel errDynamicUserMaxInvalid: dynamic_user_max was set to a value below -1. -1 is allowed (unbounded), but any other negative value is invalid; the range sentinel compares *u.MaxDynamicUser < -1.","triggerScenarios":"Setting dynamic_user_max to an integer < -1 (e.g. -2) in the users config block or UsersConfig struct, then calling Validate().","commonSituations":"Sign error when entering the UID range ceiling; assuming any negative value disables the feature (only -1 does); copy-paste of a negative sentinel to the wrong field.","solutions":["Change dynamic_user_max to a non-negative integer or -1 to disable dynamic users.","Also ensure max >= min once both are valid to avoid a logically inverted range.","Match with errors.Is(err, errDynamicUserMaxInvalid) in tests."],"exampleFix":"// before\nusers {\n  dynamic_user_min = 1000\n  dynamic_user_max = -2\n}\n\n// after\nusers {\n  dynamic_user_min = 1000\n  dynamic_user_max = 1500\n}","handlingStrategy":"validation","validationCode":"if u != nil && u.MaxDynamicUser != nil && *u.MaxDynamicUser < -1 {\n    return fmt.Errorf(\"dynamic_user_max must be >= -1\")\n}","typeGuard":null,"tryCatchPattern":"if err := u.Validate(); err != nil {\n    if errors.Is(err, errDynamicUserMaxInvalid) {\n        return fmt.Errorf(\"dynamic_user_max must be a UID or -1 to disable\")\n    }\n    return err\n}","preventionTips":["Only -1 may be negative; any other negative value is invalid.","Validate min <= max once both values are set.","Lint agent configs for out-of-range dynamic user bounds."],"tags":["nomad","agent-config","validation","range-check"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}