{"record":{"id":"0d610cab975019bb","repo":"nektos/act","slug":"bad-mode-specified-s","errorCode":null,"errorMessage":"bad mode specified: %s","messagePattern":"bad mode specified: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/container/docker_cli.go","lineNumber":1129,"sourceCode":"\t}\n\tswitch len(split) {\n\tcase 1:\n\t\tcontainerPath = split[0]\n\t\tval = path.Clean(containerPath)\n\tcase 2:\n\t\tif isValid := validator(split[1]); isValid {\n\t\t\tcontainerPath = split[0]\n\t\t\tmode = split[1]\n\t\t\tval = fmt.Sprintf(\"%s:%s\", path.Clean(containerPath), mode)\n\t\t} else {\n\t\t\tcontainerPath = split[1]\n\t\t\tval = fmt.Sprintf(\"%s:%s\", split[0], path.Clean(containerPath))\n\t\t}\n\tcase 3:\n\t\tcontainerPath = split[1]\n\t\tmode = split[2]\n\t\tif isValid := validator(split[2]); !isValid {\n\t\t\treturn val, fmt.Errorf(\"bad mode specified: %s\", mode)\n\t\t}\n\t\tval = fmt.Sprintf(\"%s:%s:%s\", split[0], containerPath, mode)\n\t}\n\n\tif !path.IsAbs(containerPath) {\n\t\treturn val, fmt.Errorf(\"%s is not an absolute path\", containerPath)\n\t}\n\treturn val, nil\n}\n\n// validateAttach validates that the specified string is a valid attach option.\nfunc validateAttach(val string) (string, error) {\n\ts := strings.ToLower(val)\n\tif slices.Contains([]string{\"stdin\", \"stdout\", \"stderr\"}, s) {\n\t\treturn s, nil\n\t}\n\treturn val, errors.New(\"valid streams are STDIN, STDOUT and STDERR\")\n}","sourceCodeStart":1111,"sourceCodeEnd":1147,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/container/docker_cli.go#L1111-L1147","documentation":"In the three-segment case (host:container:mode), validateLinuxPath runs the third segment through the device-mode validator (a non-empty ordered subset of 'rwm'). If it is not a valid mode, 'bad mode specified' is returned showing the offending mode.","triggerScenarios":"Passing a mode segment that is empty, contains letters outside r/w/m (e.g. 'rwxa'), or duplicates like 'rr'. Example: --device /dev/x:/dev/x:rox.","commonSituations":"Assuming chmod-style modes (4, 6, 755) or mount option vocabulary (ro, rw) instead of Docker's rwm device modes.","solutions":["Use only the letters r, w, m for the mode, e.g. rwm, rw, or r","Drop the mode entirely for the default rwm: --device /dev/x:/dev/x","Do not use ro/rw/chmod octals — they are invalid for devices"],"exampleFix":"# before\n--device /dev/x:/dev/x:ro\n\n# after\n--device /dev/x:/dev/x:r","handlingStrategy":"validation","validationCode":"// Go: mirror validDeviceMode\nfunc isValidDeviceMode(m string) bool {\n    if m == \"\" { return false }\n    seen := map[rune]bool{}\n    for _, r := range m {\n        if r != 'r' && r != 'w' && r != 'm' { return false }\n        if seen[r] { return false }\n        seen[r] = true\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Device modes are r/w/m only — not ro, not octal, not mount flags","Omit the mode segment to get the default rwm"],"tags":["docker","device-mapping","mode-validation"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}