{"record":{"id":"13e0b33b5da989d3","repo":"amir20/dozzle","slug":"container-actions-are-not-enabled","errorCode":null,"errorMessage":"container actions are not enabled","messagePattern":"container actions are not enabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/cloud/tools.go","lineNumber":366,"sourceCode":"// requiresActions lists tools gated behind --enable-actions.\nvar requiresActions = map[string]struct{}{\n\ttoolStartContainer:           {},\n\ttoolStopContainer:            {},\n\ttoolRestartContainer:         {},\n\ttoolRemoveContainer:          {},\n\ttoolUpdateContainer:          {},\n\ttoolCreateLogNotification:    {},\n\ttoolCreateMetricNotification: {},\n\ttoolCreateEventNotification:  {},\n}\n\nfunc executeTool(ctx context.Context, name string, argsJSON string, deps ToolDeps) (*pb.CallToolResponse, error) {\n\tif ctx.Err() != nil {\n\t\treturn nil, ctx.Err()\n\t}\n\n\tif _, gated := requiresActions[name]; gated && !deps.EnableActions {\n\t\treturn nil, fmt.Errorf(\"container actions are not enabled\")\n\t}\n\n\tswitch name {\n\tcase toolListHosts:\n\t\treturn executeListHosts(deps)\n\tcase toolFindContainers:\n\t\treturn executeFindContainers(argsJSON, deps)\n\tcase toolListRunningContainers:\n\t\treturn executeListRunningContainers(deps)\n\tcase toolListAllContainers:\n\t\treturn executeListAllContainers(deps)\n\tcase toolGetRunningContainerStats:\n\t\treturn executeGetRunningContainerStats(deps)\n\tcase toolFetchContainerLogs:\n\t\treturn executeFetchContainerLogs(ctx, argsJSON, deps)\n\tcase toolInspectContainer:\n\t\treturn executeInspectContainer(argsJSON, deps)\n\tcase toolListNotifications:","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/amir20/dozzle/blob/d9463cbe21874e44ab79db6fa63e746ca7d22928/internal/cloud/tools.go#L348-L384","documentation":"executeTool gates action tools (start/stop/restart) behind the EnableActions flag: if a requested tool name is in requiresActions and ToolDeps.EnableActions is false, the call is rejected with this fixed message. Container actions are a dangerous capability, so they are opt-in. This is a configuration-level denial, not a runtime failure.","triggerScenarios":"A cloud ToolRequest names an action tool (e.g. container restart/stop/start) while the cloud client was created with enableActions=false.","commonSituations":"Cloud AI assistant tries to restart a container but the user never enabled actions; deployment deliberately runs with actions disabled for safety.","solutions":["Enable container actions when creating the cloud client (enableActions: true) if intended","Restrict the tool set sent to AvailableTools()/ListTools so action tools are not advertised","Instruct cloud users that actions require explicit opt-in","If actions should stay off, treat the error as expected and surface a clear denial message"],"exampleFix":"// before\ncloud.NewClient(..., false /* enableActions */)\n// after\ncloud.NewClient(..., true /* enableActions */)","handlingStrategy":"validation","validationCode":"// check gating before advertising/dispatching tools\nif requiresActions[name] && !deps.EnableActions {\n    return nil, fmt.Errorf(\"tool %q requires enableActions\", name)\n}","typeGuard":null,"tryCatchPattern":"resp, err := executeTool(ctx, name, args, deps)\nif err != nil && strings.Contains(err.Error(), \"container actions are not enabled\") {\n    return toolDeniedResponse(\"actions are disabled in this deployment\")\n}","preventionTips":["Only advertise enabled tools in AvailableTools/ListTools","Document the enableActions flag for cloud users","Filter cloud requests for action tools when actions are disabled","Surface the denial clearly instead of treating it as a bug"],"tags":["cloud","tools","permissions","feature-gate","actions"],"backgroundTag":"feature-not-enabled","analyzedSha":"d9463cbe21874e44ab79db6fa63e746ca7d22928","analyzedAt":"2026-09-07T10:08:55.855Z","contentChangedAt":"2026-09-07T10:08:55.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}