{"record":{"id":"b0541bb3ddb72c23","repo":"hashicorp/nomad","slug":"invalid-port-d-out-of-range","errorCode":null,"errorMessage":"invalid port %d (out of range)","messagePattern":"invalid port (.+?) \\(out of range\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/network.go","lineNumber":487,"sourceCode":"// AssignTaskNetwork supports the deprecated task.resources.network block.\nfunc (idx *NetworkIndex) AssignPorts(ask *NetworkResource) (AllocatedPorts, error) {\n\tvar offer AllocatedPorts\n\tvar portsInOffer []int\n\n\t// index of host network name to slice of reserved ports, used during dynamic port assignment\n\treservedIdx := map[string][]Port{}\n\n\tfor _, port := range ask.ReservedPorts {\n\t\treservedIdx[port.HostNetwork] = append(reservedIdx[port.HostNetwork], port)\n\n\t\t// allocPort is set in the inner for loop if a port mapping can be created\n\t\t// if allocPort is still nil after the loop, the port wasn't available for reservation\n\t\tvar allocPort *AllocatedPortMapping\n\t\tvar addrErr error\n\t\tfor _, addr := range idx.HostNetworks[port.HostNetwork] {\n\t\t\t// Guard against invalid port\n\t\t\tif port.Value < 0 || port.Value >= MaxValidPort {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid port %d (out of range)\", port.Value)\n\t\t\t}\n\n\t\t\t// Check if in use\n\t\t\tif !port.IgnoreCollision {\n\t\t\t\tused := idx.getUsedPortsFor(addr.Address)\n\t\t\t\tif used != nil && used.Check(uint(port.Value)) {\n\t\t\t\t\taddrErr = fmt.Errorf(\"reserved port collision %s=%d\", port.Label, port.Value)\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tallocPort = &AllocatedPortMapping{\n\t\t\t\tLabel:           port.Label,\n\t\t\t\tValue:           port.Value,\n\t\t\t\tTo:              port.To,\n\t\t\t\tHostIP:          addr.Address,\n\t\t\t\tIgnoreCollision: port.IgnoreCollision,\n\t\t\t}","sourceCodeStart":469,"sourceCodeEnd":505,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/network.go#L469-L505","documentation":"AssignPorts rejects a port value that falls outside the valid range [0, MaxValidPort) while assigning dynamic or static ports for an allocation's network. The guard prevents an invalid port value from being checked against the used-port bitmap and producing nonsensical reservations. It means the task's port stanza carries a value the scheduler considers out of range.","triggerScenarios":"A job's network port stanza has a static port value that is negative or >= MaxValidPort (e.g. a value above the valid port ceiling) reaching the scheduler during port assignment; the check runs per host network in the allocation loop.","commonSituations":"Job files with static = 70000+ or other out-of-range literals that skipped client/job validation (e.g. via API submission without Nomad CLI validation); template-generated jobs computing port numbers incorrectly; older clients/versions with different port ceilings.","solutions":["Fix the job spec so every static port value is within 0-65535 (and below the scheduler's MaxValidPort ceiling), then resubmit","Run nomad job validate (or the /v1/validate endpoints) before submitting jobs to catch out-of-range ports","Check for arithmetic/template errors generating the port number in your job templating","Ensure all clients and servers run compatible Nomad versions so validation and port ceilings agree"],"exampleFix":"// before\nport \"web\" { static = 70000 }\n// after\nport \"web\" { static = 8080 }","handlingStrategy":"validation","validationCode":"func validateStaticPorts(job *api.Job) error {\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, t := range tg.Tasks {\n\t\t\tfor _, r := range t.Resources.Networks {\n\t\t\t\tfor _, p := range r.DynamicPorts {\n\t\t\t\t\tif p.Value < 0 || p.Value >= 65536 {\n\t\t\t\t\t\treturn fmt.Errorf(\"port %s value %d out of range\", p.Label, p.Value)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"err := client.Jobs().Validate(job, nil, nil)\nif err != nil {\n\t// reject/fix job spec before submit; do not attempt scheduling\n}","preventionTips":["Run nomad job validate (or POST /v1/validate/job) before every job submission","Keep all static port literals within 0-65535 in job files","Review templating that computes port numbers for off-by-one/arithmetic bugs","Keep clients and servers on compatible Nomad versions so port ceilings match"],"tags":["nomad","scheduler","ports","job-spec"],"backgroundTag":"invalid-port-range","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}