What causes "range bound not valid" in hashicorp/nomad?

Correct the bounds string so both endpoints are plain decimal integers, e.g. "1000-2000"

ErrInvalidBound

ErrInvalidBound

Error message

range bound not valid

What it means

ErrInvalidBound is returned by the validators package's validateBounds when a bound in a UID/GID range string cannot be parsed as a uint32. Range strings use the form "low-high" (or a deny-list), and each endpoint must be a decimal number; anything non-numeric makes the whole range specification invalid.

Source

Thrown at drivers/shared/validators/validators.go:18

// Copyright IBM Corp. 2015, 2026
// SPDX-License-Identifier: MPL-2.0

package validators

import (
	"errors"
	"fmt"
	"strconv"
	"strings"

	"github.com/hashicorp/go-hclog"
	"github.com/hashicorp/nomad/client/lib/idset"
	"github.com/hashicorp/nomad/helper/users"
)

var (
	ErrInvalidBound = errors.New("range bound not valid")
	//ErrEmptyRange   = errors.New("range value cannot be empty")
	ErrInvalidRange = errors.New("lower bound cannot be greater than upper bound")
)

type (

	// A GroupID (GID) represents a unique numerical value assigned to each user group.
	GroupID uint64

	// A UserID represents a unique numerical value assigned to each user account.
	UserID uint64
)

type Validator struct {
	// DeniedHostUids configures which host uids are disallowed
	deniedUIDs *idset.Set[UserID]

	// DeniedHostGids configures which host gids are disallowed

View on GitHub (pinned to 482b49bf1a)

Solutions

Correct the bounds string so both endpoints are plain decimal integers, e.g. "1000-2000"
Check the client config for interpolated variables that expand to non-numeric values
Trim whitespace/quotes from the configured range value
Validate the range with a quick parse locally before deploying the client config

Example fix

// before
bounds = "banana-10"
// after
bounds = "1-10"

Defensive patterns

Strategy: validation

Validate before calling

func validBounds(s string) error {
    parts := strings.Split(s, "-")
    for _, p := range parts {
        if _, err := strconv.ParseUint(strings.TrimSpace(p), 10, 32); err != nil {
            return fmt.Errorf("bound %q is not a valid uint32: %w", p, err)
        }
    }
    return nil
}

Type guard

func isNumericBound(s string) bool { _, err := strconv.ParseUint(s, 10, 32); return err == nil }

Try / catch

if err := validators.ValidateBounds(cfg.Bounds); err != nil {
    if errors.Is(err, validators.ErrInvalidBound) {
        return fmt.Errorf("range %q has a non-numeric bound: %w", cfg.Bounds, err)
    }
    return err
}

Prevention

Use plain decimal integers for both range endpoints
Check templated values resolve to numbers before deploy
Trim whitespace and stray quotes from range config values

When it happens

Trigger: Passing a bounds string like "banana-10" or "10-banana" to validateBounds (used for validating allowed/disallowed UID/GID ranges, e.g. in the exec driver's uid/gid range config); strconv.ParseUint fails on the non-numeric endpoint.

Common situations: Typo'd ranges in client config (allow_caps-style list confusion); templating errors injecting empty or placeholder values; copying ranges with units like "1000-2000k"; whitespace or invisible characters in the config value.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/46f6d0c7d8cddeb4. Report an issue: GitHub.