{"record":{"id":"fff4d09c21295697","repo":"hashicorp/nomad","slug":"dynamic-user-min-must-not-be-negative","errorCode":null,"errorMessage":"dynamic_user_min must not be negative","messagePattern":"dynamic_user_min must not be negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/config/users.go","lineNumber":66,"sourceCode":"// Equal returns whether u and o are the same.\nfunc (u *UsersConfig) Equal(o *UsersConfig) bool {\n\tif u == nil || o == nil {\n\t\treturn u == o\n\t}\n\tswitch {\n\tcase !pointer.Eq(u.MinDynamicUser, o.MinDynamicUser):\n\t\treturn false\n\tcase !pointer.Eq(u.MaxDynamicUser, o.MaxDynamicUser):\n\t\treturn false\n\tdefault:\n\t\treturn true\n\t}\n}\n\nvar (\n\terrUsersUnset            = errors.New(\"users must not be nil\")\n\terrDynamicUserMinUnset   = errors.New(\"dynamic_user_min must be set\")\n\terrDynamicUserMinInvalid = errors.New(\"dynamic_user_min must not be negative\")\n\terrDynamicUserMaxUnset   = errors.New(\"dynamic_user_max must be set\")\n\terrDynamicUserMaxInvalid = errors.New(\"dynamic_user_max must not be negative\")\n)\n\n// Validate whether UsersConfig is valid.\n//\n// Note that -1 is a valid value for min/max dynamic users, as this is used\n// to indicate the dynamic workload users feature should be disabled.\nfunc (u *UsersConfig) Validate() error {\n\tif u == nil {\n\t\treturn errUsersUnset\n\t}\n\tif u.MinDynamicUser == nil {\n\t\treturn errDynamicUserMinUnset\n\t}\n\tif *u.MinDynamicUser < -1 {\n\t\treturn errDynamicUserMinInvalid\n\t}","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/config/users.go#L48-L84","documentation":"errDynamicUserMinInvalid is returned when *MinDynamicUser is less than -1. Only values >= 0 (a real UID) or exactly -1 (feature disabled) are accepted, so negative numbers below -1 are rejected as invalid configuration.","triggerScenarios":"Setting dynamic_user_min to any integer < -1 (e.g. -2, -100) in the users config block or in a UsersConfig struct, then running Validate().","commonSituations":"Typo or sign error in the config (meaning to write 1000 but writing -1000); misunderstanding that -1 is the only legal negative value (a sentinel for \"disable\").","solutions":["Change dynamic_user_min to a non-negative UID or to -1 if you intend to disable dynamic users.","Add a pre-submission check in config tooling: value < -1 is invalid.","In tests, expect errors.Is(err, errDynamicUserMinInvalid) for this case."],"exampleFix":"// before\nusers {\n  dynamic_user_min = -2\n  dynamic_user_max = 1500\n}\n\n// after\nusers {\n  dynamic_user_min = -1  # or a valid UID like 1000\n  dynamic_user_max = 1500\n}","handlingStrategy":"validation","validationCode":"if u != nil && u.MinDynamicUser != nil && *u.MinDynamicUser < -1 {\n    return fmt.Errorf(\"dynamic_user_min must be >= -1\")\n}","typeGuard":null,"tryCatchPattern":"if err := u.Validate(); err != nil {\n    if errors.Is(err, errDynamicUserMinInvalid) {\n        return fmt.Errorf(\"dynamic_user_min must be a UID or -1 to disable\")\n    }\n    return err\n}","preventionTips":["Remember -1 is the only legal negative value (feature disabled).","Clamp or reject negative values in config tooling before writing agent config.","Note the check is `< -1`, not `< 0`, when writing validators."],"tags":["nomad","agent-config","validation","range-check"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}