amir20/dozzle · error

user has an invalid filter

Error message

user %s has an invalid filter %q: %w

What it means

While decoding users.yml, each user's container filter string is validated via container.ParseContainerFilter. If the filter cannot be parsed into container label filters, decodeUsersFromFile aborts loading the users file with this wrapped error naming the user and the offending filter string. Authentication setup fails until the config is fixed.

Solutions

1. Open users.yml and fix the 'filter' value for the named user to valid 'label=value' pairs
2. Check the wrapped ParseContainerFilter error for the exact parse problem
3. Compare against documented filter syntax in Dozzle docs (dev.dozzle.* labels)
4. Validate the YAML so the filter is a clean string, not a list accidentally coerced into one

Example fix

// users.yml
// before
user:
  filter: "env=prod, team"
// after
user:
  filter: "env=prod"

// before reading users.yml, validate each filter string
for _, u := range rawUsers {
    if _, err := container.ParseContainerFilter(u.Filter); err != nil {
        return fmt.Errorf("user %q: bad filter %q: %w", u.Name, u.Filter, err)
    }
}

users, err := auth.ReadUsersFromFile(path)
if err != nil {
    log.Fatalf("invalid users config: %v", err) // error names user and filter
}

When it happens

Trigger: A user entry in users.yml has a 'filter' value that ParseContainerFilter rejects, e.g. a filter not in key=value form, unsupported keys, or malformed label expressions.

Common situations: Typo in a label key, using comma/space-separated syntax the parser does not accept, quoting mistakes in YAML leaving stray characters in the filter string, or copying Docker filter syntax incompatible with Dozzle's parser.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid filter
• invalid webhook URL
• failed to parse template
• username is required
• Bad Request

AI-assisted analysis of amir20/dozzle@d9463cbe21 (2026-09-07). Data as JSON: /api/errors/b56ec37d2e65a01a. Report an issue: GitHub.

Appendix: source

Thrown at internal/auth/users.go:122

		}

		if !(len(user.Password) == 64 || len(user.Password) == 60) {
			log.Fatal().Str("password", user.Password).Str("user", username).Msg("Invalid password for user")
		}

		if user.Name == "" {
			user.Name = username
		}

		if strings.TrimSpace(user.RolesConfigured) == "" {
			user.RolesConfigured = "all"
		}

		user.Roles = ParseRole(user.RolesConfigured)

		labels, err := container.ParseContainerFilter(user.Filter)
		if err != nil {
			return users, fmt.Errorf("user %s has an invalid filter %q: %w", username, user.Filter, err)
		}
		user.ContainerLabels = labels
	}

	return users, nil
}

func (u *UserDatabase) readFileIfChanged() error {
	if u.Path == "" {
		return nil
	}
	info, err := os.Stat(u.Path)
	if err != nil {
		return err
	}

	if info.ModTime().After(u.LastRead) {
		log.Info().Msg("Reloading user database")

View on GitHub (pinned to d9463cbe21)