SecretsMB value (%d) cannot be larger than MemoryMB value (%

Error message

SecretsMB value (%d) cannot be larger than MemoryMB value (%d)

What it means

Resources.Validate() enforces that SecretsMB (reserved secret memory) never exceeds the task's total MemoryMB. SecretsMB carves a slice out of the task's memory for secret material, so it cannot be larger than the whole allocation. The value is accumulated into the multierror returned from job validation.

Source

Thrown at nomad/structs/structs.go:2470

			if !devices.Contains(numaDevice) {
				mErr.Errors = append(mErr.Errors, fmt.Errorf("numa device %q not requested as task resource", numaDevice))
			}
		}
	}

	// Ensure the numa block is valid
	if err := r.NUMA.Validate(); err != nil {
		mErr.Errors = append(mErr.Errors, err)
	}

	// Ensure memory_max is greater than memory, unless it is set to 0 or -1 which
	// are both sentinel values
	if (r.MemoryMaxMB != 0 && r.MemoryMaxMB != MemoryNoLimit) && r.MemoryMaxMB < r.MemoryMB {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("MemoryMaxMB value (%d) should be larger than MemoryMB value (%d)", r.MemoryMaxMB, r.MemoryMB))
	}

	if r.SecretsMB > r.MemoryMB {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("SecretsMB value (%d) cannot be larger than MemoryMB value (%d)", r.SecretsMB, r.MemoryMB))
	}
	if r.SecretsMB < 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("SecretsMB value (%d) cannot be negative", r.SecretsMB))
	}

	return mErr.ErrorOrNil()
}

// Merge merges this resource with another resource.
// COMPAT(0.10): Remove in 0.10
func (r *Resources) Merge(other *Resources) {
	if other.CPU != 0 {
		r.CPU = other.CPU
	}
	if other.Cores != 0 {
		r.Cores = other.Cores
	}
	if other.MemoryMB != 0 {

View on GitHub (pinned to 482b49bf1a)

Solutions

Lower SecretsMB (secrets_mb) so it is <= MemoryMB
Increase MemoryMB so it is >= SecretsMB
Remove secrets_mb if the task does not need reserved secret memory

Example fix

// before
resources {
  memory     = 128
  secrets_mb = 256
}
// after
resources {
  memory     = 512
  secrets_mb = 256
}

Defensive patterns

Strategy: validation

Validate before calling

if r.SecretsMB > r.MemoryMB {
    return fmt.Errorf("secrets_mb (%d) must be <= memory (%d)", r.SecretsMB, r.MemoryMB)
}

Type guard

func validSecretsMB(mem, secrets int) bool { return secrets >= 0 && secrets <= mem }

Prevention

Treat secrets_mb as a subset of memory, not an additional pool
Recompute secrets_mb whenever you scale memory down
Lint job specs to assert secrets_mb <= memory

When it happens

Trigger: Submitting a job where task Resources.SecretsMB > Resources.MemoryMB, e.g. secrets_mb = 256 with memory = 128.

Common situations: Misunderstanding secrets_mb as a standalone pool rather than a sub-allocation of memory; scaling memory down after setting secrets_mb; copy-pasting resource blocks between tasks with different memory sizes.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2d3298079790b69a. Report an issue: GitHub.