hashicorp/nomad · error

invalid user ID %q: %w

Error message

invalid user ID %q: %w

What it means

The requireUIDisUint helper parses transparent-proxy UIDs with strconv.ParseUint(uid, 10, 16). If the value fails to parse as an unsigned 16-bit integer and the error is not a recognized *strconv.NumError, it is wrapped generically as 'invalid user ID'.

Source

Thrown at nomad/structs/connect.go:134

func (tp *ConsulTransparentProxy) Validate() error {
	var mErr multierror.Error

	for _, rawCidr := range tp.ExcludeOutboundCIDRs {
		_, err := netip.ParsePrefix(rawCidr)
		if err != nil {
			// note: error returned always include parsed string
			mErr.Errors = append(mErr.Errors,
				fmt.Errorf("could not parse transparent proxy excluded outbound CIDR as network prefix: %w", err))
		}
	}

	requireUIDisUint := func(uidRaw string) error {
		_, err := strconv.ParseUint(uidRaw, 10, 16)
		if err != nil {
			e, ok := err.(*strconv.NumError)
			if !ok {
				return fmt.Errorf("invalid user ID %q: %w", uidRaw, err)
			}
			return fmt.Errorf("invalid user ID %q: %w", uidRaw, e.Err)
		}
		return nil
	}

	if tp.UID != "" {
		if err := requireUIDisUint(tp.UID); err != nil {
			mErr.Errors = append(mErr.Errors,
				fmt.Errorf("transparent proxy block has invalid UID field: %w", err))
		}
	}
	for _, uid := range tp.ExcludeUIDs {
		if err := requireUIDisUint(uid); err != nil {
			mErr.Errors = append(mErr.Errors,
				fmt.Errorf("transparent proxy block has invalid ExcludeUIDs field: %w", err))
		}
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set the UID field to a plain numeric string between 0 and 65535
2. Trim whitespace and remove any non-digit characters from the value
3. Look up the numeric UID on the host (id -u <user>) and use that

Example fix

// before
transparent_proxy {
  uid = "nomad"
}
// after
transparent_proxy {
  uid = "1000"
}

func validUID(s string) bool {
    _, err := strconv.ParseUint(strings.TrimSpace(s), 10, 16)
    return err == nil
}

if err := requireUIDisUint(tp.UID); err != nil {
    return fmt.Errorf("rejecting job: %w", err)
}

When it happens

Trigger: requireUIDisUint receives a UID string with non-numeric characters, leading '+' signs, or is empty-spaced, and the returned error is not a NumError (uncommon parse failures).

Common situations: Passing usernames instead of numeric UIDs; whitespace or BOM characters in the config value; values exceeding uint16 range in variant paths.

Related errors

• validator: %w
• running as uid %d is disallowed
• could not parse transparent proxy excluded outbound CIDR as
• transparent proxy block has invalid UID field: %w
• transparent proxy block has invalid ExcludeUIDs field: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/d8500c87ffad53ba. Report an issue: GitHub.