{"record":{"id":"ba636ae0d8a1a82f","repo":"hashicorp/nomad","slug":"port-s-d-cannot-be-greater-than-d","errorCode":null,"errorMessage":"Port %s (%d) cannot be greater than %d","messagePattern":"Port (.+?) \\((.+?)\\) cannot be greater than (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":7358,"sourceCode":"\t\t\t}\n\n\t\t\tif port.Value != 0 {\n\t\t\t\thostNetwork := port.HostNetwork\n\t\t\t\tif hostNetwork == \"\" {\n\t\t\t\t\thostNetwork = \"default\"\n\t\t\t\t}\n\t\t\t\tstaticPorts, ok := staticPortsIndex[hostNetwork]\n\t\t\t\tif !ok {\n\t\t\t\t\tstaticPorts = make(map[int]string)\n\t\t\t\t}\n\t\t\t\t// static port\n\t\t\t\tif other, ok := staticPorts[port.Value]; ok {\n\t\t\t\t\tif !port.IgnoreCollision {\n\t\t\t\t\t\terr := fmt.Errorf(\"Static port %d already reserved by %s\", port.Value, other)\n\t\t\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t\t\t}\n\t\t\t\t} else if port.Value > math.MaxUint16 {\n\t\t\t\t\terr := fmt.Errorf(\"Port %s (%d) cannot be greater than %d\", port.Label, port.Value, math.MaxUint16)\n\t\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t\t} else {\n\t\t\t\t\tstaticPorts[port.Value] = fmt.Sprintf(\"taskgroup network:%s\", port.Label)\n\t\t\t\t\tstaticPortsIndex[hostNetwork] = staticPorts\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif port.To < -1 {\n\t\t\t\terr := fmt.Errorf(\"Port %q cannot be mapped to negative value %d\", port.Label, port.To)\n\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t} else if port.To > math.MaxUint16 {\n\t\t\t\terr := fmt.Errorf(\"Port %q cannot be mapped to a port (%d) greater than %d\", port.Label, port.To, math.MaxUint16)\n\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t}\n\n\t\t\tif port.IgnoreCollision && !(net.Mode == \"\" || net.Mode == \"host\") {\n\t\t\t\terr := fmt.Errorf(\"Port %q collision may not be ignored on non-host network mode %q\", port.Label, net.Mode)\n\t\t\t\tmErr.Errors = append(mErr.Errors, err)","sourceCodeStart":7340,"sourceCodeEnd":7376,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L7340-L7376","documentation":"In TaskGroup network port validation, a static port value exceeded 65535 (math.MaxUint16), which cannot be represented as a valid port; the label and offending value are included in the message.","triggerScenarios":"Declaring a network port with `static = <n>` where n > 65535 (or ReservedPorts.Value > 65535) in a task group network block — often from unit confusion (e.g. typo'd digits) or programmatic spec generation.","commonSituations":"Copy/paste mistakes like static = 655360; scripts computing ports from offsets that overflow; confusing `to` (container port, also uint16-bounded) values; JSON job specs with unvalidated user input.","solutions":["Correct the static value to <= 65535","If the intended container-side port exceeds 65535, that's invalid — use a valid port","Use a dynamic port (omit static value) if you don't need a fixed host port","Add pre-submit validation in tooling that generates job specs to clamp/check port ranges"],"exampleFix":"// before\nnetwork {\n  port \"web\" { static = 655360 }\n}\n// after\nnetwork {\n  port \"web\" { static = 8080 }\n}","handlingStrategy":"validation","validationCode":"const maxPort = 65535\nfunc portsInRange(tg *api.TaskGroup) error {\n  for _, n := range tg.Networks {\n    for _, p := range append(n.ReservedPorts, n.DynamicPorts...) {\n      if p.Value < 0 || p.Value > maxPort { return fmt.Errorf(\"port %q value %d out of range\", p.Label, p.Value) }\n      if p.To > maxPort { return fmt.Errorf(\"port %q 'to' %d out of range\", p.Label, p.To) }\n    }\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Clamp/validate port numbers in any tooling that generates job specs","Beware digit typos when hand-writing static values (655360 vs 65536)","Remember both static host ports and `to` container ports are uint16-bounded","Run `nomad job validate` before submit in CI"],"tags":["nomad","network","ports","range-validation"],"backgroundTag":"port-out-of-range","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}