What causes "limit must be greater than or equal to 0 but found %d" in hashicorp/nomad?

Set `limit` to a non-negative integer (e.g. 1-3)

limit must be greater than or equal to 0 but found %d

Error message

limit must be greater than or equal to 0 but found %d

What it means

CheckRestart.Validate() rejects a negative `limit` value. `limit` bounds how many restarts the check restart policy allows, so it must be >= 0 (0 meaning unlimited/none per semantics); a negative value is always a config mistake.

Source

Thrown at nomad/structs/structs.go:7826

	if c.Grace != o.Grace {
		return false
	}

	if c.IgnoreWarnings != o.IgnoreWarnings {
		return false
	}

	return true
}

func (c *CheckRestart) Validate() error {
	if c == nil {
		return nil
	}

	var mErr multierror.Error
	if c.Limit < 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("limit must be greater than or equal to 0 but found %d", c.Limit))
	}

	if c.Grace < 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("grace period must be greater than or equal to 0 but found %d", c.Grace))
	}

	return mErr.ErrorOrNil()
}

const (
	// DefaultKillTimeout is the default timeout between signaling a task it
	// will be killed and killing it.
	DefaultKillTimeout = 5 * time.Second
)

// LogConfig provides configuration for log rotation
type LogConfig struct {
	MaxFiles      int

View on GitHub (pinned to 482b49bf1a)

Solutions

Set `limit` to a non-negative integer (e.g. 1-3)
Remove the `limit` field to use the default
Clamp/validate the value in your templating layer before rendering HCL

Example fix

// before
check_restart { limit = -1 }
// after
check_restart { limit = 3 }

Defensive patterns

Strategy: validation

Validate before calling

if cr != nil && cr.Limit < 0 {
  return fmt.Errorf("check_restart.limit must be >= 0, got %d", cr.Limit)
}

Type guard

func validCheckRestart(cr *api.CheckRestart) bool {
  return cr == nil || (cr.Limit >= 0 && cr.Grace >= 0)
}

Prevention

Clamp templated limit values: if v < 0 { v = 0 }
Default limit via omitted field instead of explicit negatives
Unit-test job-rendering code with edge-case inputs

When it happens

Trigger: Submitting a job with a `check_restart { limit = -N }` block (or CheckRestart struct with Limit < 0) on a service check.

Common situations: Templating limit from an environment variable/parameter that is unset or negative; typos like `limit = -1`; arithmetic producing negative defaults.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1bdecb91f1fdcbaf. Report an issue: GitHub.