hashicorp/nomad · error

port must be < %d but found %d

Error message

port must be < %d but found %d

What it means

ParsePortRanges rejects port numbers above MaxValidPort (65535): the segment parsed as an unsigned integer but exceeds the maximum valid TCP/UDP port. Nomad enforces the standard port bound when validating reserved port lists.

Source

Thrown at nomad/structs/funcs.go:518

	ports := []uint64{}
	for _, part := range parts {
		part = strings.TrimSpace(part)
		rangeParts := strings.Split(part, "-")
		l := len(rangeParts)
		switch l {
		case 1:
			if val := rangeParts[0]; val == "" {
				return nil, fmt.Errorf("can't specify empty port")
			} else {
				port, err := strconv.ParseUint(val, 10, 0)
				if err != nil {
					return nil, err
				}
				if port == 0 {
					return nil, fmt.Errorf("port must be > 0")
				}
				if port > MaxValidPort {
					return nil, fmt.Errorf("port must be < %d but found %d", MaxValidPort, port)
				}
				count++
				if count > MaxValidPort {
					return nil, fmt.Errorf("maximum of %d ports can be reserved", MaxValidPort)
				}
				ports = append(ports, port)
			}
		case 2:
			// We are parsing a range
			start, err := strconv.ParseUint(rangeParts[0], 10, 0)
			if err != nil {
				return nil, err
			}

			end, err := strconv.ParseUint(rangeParts[1], 10, 0)
			if err != nil {
				return nil, err
			}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Correct the port to be <= 65535
2. Fix any script/variable interpolation that concatenates digits into the port value
3. For ranges, ensure both endpoints are within 1-65535 (e.g. "60000-65535")
4. Pre-validate with structs.ParsePortRanges(input) and strconv bounds before writing client config

Example fix

// before
reserved { ports = "655350" }
// after
reserved { ports = "65535" }

// go: enforce the 1-65535 bound before parsing
if v, err := strconv.ParseUint(portSpec, 10, 32); err == nil && v > 65535 {
    return fmt.Errorf("port %d exceeds maximum 65535", v)
}

if _, err := structs.ParsePortRanges(portSpec); err != nil {
    if strings.Contains(err.Error(), fmt.Sprintf("port must be < %d", structs.MaxValidPort)) {
        return fmt.Errorf("port out of range in %q", portSpec)
    }
    return err
}

When it happens

Trigger: ParsePortRanges sees a single port (or range endpoint) where port > MaxValidPort, e.g. "80800"; raised from node registration validation via SetNode/IsValidConfig.

Common situations: Typos with an extra digit (6553 -> 65535 -> 655350); decimal/octal confusion from scripts; concatenation bugs where a port string got two numbers glued together.

Related errors

• can't specify empty port
• port must be > 0
• wait config is nil or empty
• missing datacenter for client registration
• default_identity_ttl must be greater than 0

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4547412ede57d468. Report an issue: GitHub.