hashicorp/nomad · error

dynamic_user_min must not be negative

Error message

dynamic_user_min must not be negative

What it means

errDynamicUserMinInvalid is returned when *MinDynamicUser is less than -1. Only values >= 0 (a real UID) or exactly -1 (feature disabled) are accepted, so negative numbers below -1 are rejected as invalid configuration.

Source

Thrown at nomad/structs/config/users.go:66

// Equal returns whether u and o are the same.
func (u *UsersConfig) Equal(o *UsersConfig) bool {
	if u == nil || o == nil {
		return u == o
	}
	switch {
	case !pointer.Eq(u.MinDynamicUser, o.MinDynamicUser):
		return false
	case !pointer.Eq(u.MaxDynamicUser, o.MaxDynamicUser):
		return false
	default:
		return true
	}
}

var (
	errUsersUnset            = errors.New("users must not be nil")
	errDynamicUserMinUnset   = errors.New("dynamic_user_min must be set")
	errDynamicUserMinInvalid = errors.New("dynamic_user_min must not be negative")
	errDynamicUserMaxUnset   = errors.New("dynamic_user_max must be set")
	errDynamicUserMaxInvalid = errors.New("dynamic_user_max must not be negative")
)

// Validate whether UsersConfig is valid.
//
// Note that -1 is a valid value for min/max dynamic users, as this is used
// to indicate the dynamic workload users feature should be disabled.
func (u *UsersConfig) Validate() error {
	if u == nil {
		return errUsersUnset
	}
	if u.MinDynamicUser == nil {
		return errDynamicUserMinUnset
	}
	if *u.MinDynamicUser < -1 {
		return errDynamicUserMinInvalid
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change dynamic_user_min to a non-negative UID or to -1 if you intend to disable dynamic users.
2. Add a pre-submission check in config tooling: value < -1 is invalid.
3. In tests, expect errors.Is(err, errDynamicUserMinInvalid) for this case.

Example fix

// before
users {
  dynamic_user_min = -2
  dynamic_user_max = 1500
}

// after
users {
  dynamic_user_min = -1  # or a valid UID like 1000
  dynamic_user_max = 1500
}

if u != nil && u.MinDynamicUser != nil && *u.MinDynamicUser < -1 {
    return fmt.Errorf("dynamic_user_min must be >= -1")
}

if err := u.Validate(); err != nil {
    if errors.Is(err, errDynamicUserMinInvalid) {
        return fmt.Errorf("dynamic_user_min must be a UID or -1 to disable")
    }
    return err
}

When it happens

Trigger: Setting dynamic_user_min to any integer < -1 (e.g. -2, -100) in the users config block or in a UsersConfig struct, then running Validate().

Common situations: Typo or sign error in the config (meaning to write 1000 but writing -1000); misunderstanding that -1 is the only legal negative value (a sentinel for "disable").

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• dynamic_user_max must not be negative
• users must not be nil
• dynamic_user_min must be set
• dynamic_user_max must be set
• Spread block must have a positive weight from 0 to 100

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/fff4d09c21295697. Report an issue: GitHub.