amir20/dozzle · warning

container actions are not enabled

Error message

container actions are not enabled

What it means

executeTool gates action tools (start/stop/restart) behind the EnableActions flag: if a requested tool name is in requiresActions and ToolDeps.EnableActions is false, the call is rejected with this fixed message. Container actions are a dangerous capability, so they are opt-in. This is a configuration-level denial, not a runtime failure.

Solutions

1. Enable container actions when creating the cloud client (enableActions: true) if intended
2. Restrict the tool set sent to AvailableTools()/ListTools so action tools are not advertised
3. Instruct cloud users that actions require explicit opt-in
4. If actions should stay off, treat the error as expected and surface a clear denial message

Example fix

// before
cloud.NewClient(..., false /* enableActions */)
// after
cloud.NewClient(..., true /* enableActions */)

// check gating before advertising/dispatching tools
if requiresActions[name] && !deps.EnableActions {
    return nil, fmt.Errorf("tool %q requires enableActions", name)
}

resp, err := executeTool(ctx, name, args, deps)
if err != nil && strings.Contains(err.Error(), "container actions are not enabled") {
    return toolDeniedResponse("actions are disabled in this deployment")
}

When it happens

Trigger: A cloud ToolRequest names an action tool (e.g. container restart/stop/start) while the cloud client was created with enableActions=false.

Common situations: Cloud AI assistant tries to restart a container but the user never enabled actions; deployment deliberately runs with actions disabled for safety.

Related errors

• container not found
• action failed
• unknown tool
• failed to parse arguments
• cloud search failed

AI-assisted analysis of amir20/dozzle@d9463cbe21 (2026-09-07). Data as JSON: /api/errors/13e0b33b5da989d3. Report an issue: GitHub.

Appendix: source

Thrown at internal/cloud/tools.go:366

// requiresActions lists tools gated behind --enable-actions.
var requiresActions = map[string]struct{}{
	toolStartContainer:           {},
	toolStopContainer:            {},
	toolRestartContainer:         {},
	toolRemoveContainer:          {},
	toolUpdateContainer:          {},
	toolCreateLogNotification:    {},
	toolCreateMetricNotification: {},
	toolCreateEventNotification:  {},
}

func executeTool(ctx context.Context, name string, argsJSON string, deps ToolDeps) (*pb.CallToolResponse, error) {
	if ctx.Err() != nil {
		return nil, ctx.Err()
	}

	if _, gated := requiresActions[name]; gated && !deps.EnableActions {
		return nil, fmt.Errorf("container actions are not enabled")
	}

	switch name {
	case toolListHosts:
		return executeListHosts(deps)
	case toolFindContainers:
		return executeFindContainers(argsJSON, deps)
	case toolListRunningContainers:
		return executeListRunningContainers(deps)
	case toolListAllContainers:
		return executeListAllContainers(deps)
	case toolGetRunningContainerStats:
		return executeGetRunningContainerStats(deps)
	case toolFetchContainerLogs:
		return executeFetchContainerLogs(ctx, argsJSON, deps)
	case toolInspectContainer:
		return executeInspectContainer(argsJSON, deps)
	case toolListNotifications:

View on GitHub (pinned to d9463cbe21)