hashicorp/nomad · error

invalid range %s "%s": %w

Error message

invalid range %s "%s": %w

What it means

This error is returned by validateIDRange when a single element of the deniedHostUIDs or deniedHostGIDs configuration string fails syntax/bounds validation. Each comma-separated element must be either a single unsigned 32-bit integer or a 'lower-upper' range with lower <= upper; validateBounds returns ErrInvalidBound (not parseable as uint32) or ErrInvalidRange (lower > upper), and this wrapper names the offending config key and element. NewValidator therefore refuses to construct a Validator with malformed ID ranges.

Source

Thrown at drivers/shared/validators/validators.go:114

	return nil
}

// validateIDRange is used to ensure that the configuration for ID ranges is valid
// by checking the syntax and bounds.
func validateIDRange(rangeType string, deniedRanges string) error {

	parts := strings.Split(deniedRanges, ",")

	// exit early if empty string
	if len(parts) == 1 && parts[0] == "" {
		return nil
	}

	for _, rangeStr := range parts {
		err := validateBounds(rangeStr)
		if err != nil {
			return fmt.Errorf("invalid range %s \"%s\": %w", rangeType, rangeStr, err)
		}
	}

	return nil
}

func validateBounds(boundsString string) error {
	uidDenyRangeParts := strings.Split(boundsString, "-")

	switch len(uidDenyRangeParts) {
	case 1:
		disallowedIdStr := uidDenyRangeParts[0]
		if _, err := strconv.ParseUint(disallowedIdStr, 10, 32); err != nil {
			return ErrInvalidBound
		}

	case 2:
		lowerBoundStr := uidDenyRangeParts[0]

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Fix the offending element in the deniedHostUIDs/deniedHostGIDs config value named in the error so each element is 'N' or 'low-high' with low <= high and values within uint32 range
2. Remove surrounding whitespace or stray characters (commas already split elements, so '100, ' yields an empty-ish element that will fail)
3. If you only want single IDs denied, use comma-separated plain integers instead of ranges
4. Validate the range string manually before passing it to NewValidator

Example fix

// before
v, err := validators.NewValidator(logger, "0-99, 1000", "5000-1000")
// after
v, err := validators.NewValidator(logger, "0-99,1000", "1000-5000")

func validRange(s string) bool {
	if s == "" { return true }
	for _, part := range strings.Split(s, ",") {
		b := strings.Split(part, "-")
		if len(b) == 1 {
			if _, err := strconv.ParseUint(b[0], 10, 32); err != nil { return false }
		} else if len(b) == 2 {
			lo, err1 := strconv.ParseUint(b[0], 10, 32)
			hi, err2 := strconv.ParseUint(b[1], 10, 32)
			if err1 != nil || err2 != nil || lo > hi { return false }
		} else { return false }
	}
	return true
}

When it happens

Trigger: Calling NewValidator with deniedHostUIDs or deniedHostGIDs containing an element like 'abc', '5000-1000' (lower > upper), '1-2-3' (only first two parts checked, but '1-' fails parse), a number > 4294967295, or stray whitespace/negative values like '-5' or ' 100'.

Common situations: Typo'd Nomad client config blocks (client.options or similar deny-list settings), templated config injecting an empty or malformed range value, migrating configs where ranges were hand-edited, or operators writing reversed ranges like 65535-1024.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• failed to parse config:
• only one of cgroups_v1_override and cgroups_v2_override may
• work_dir must be an absolute path
• users: unable to parse uid/gid from username
• <combined HCL diagnostics from str.String()>

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/92985c1fc27ba02a. Report an issue: GitHub.