{"record":{"id":"29c709dd74ef7c47","repo":"docker/cli","slug":"no-matching-subnet-for-range-s","errorCode":null,"errorMessage":"no matching subnet for range %s","messagePattern":"no matching subnet for range (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/network/create.go","lineNumber":189,"sourceCode":"\t\t\tok, err := subnetMatches(s, r.String())\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif !ok {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\t// Using \"IsValid\" to check if a valid IPRange was already set.\n\t\t\tif iData[s].IPRange.IsValid() {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot configure multiple ranges (%s, %s) on the same subnet (%s)\", r.String(), iData[s].IPRange.String(), s)\n\t\t\t}\n\t\t\tif ipRange, ok := toPrefix(r); ok {\n\t\t\t\tiData[s].IPRange = ipRange\n\t\t\t\tmatch = true\n\t\t\t}\n\t\t}\n\t\tif !match {\n\t\t\treturn nil, fmt.Errorf(\"no matching subnet for range %s\", r.String())\n\t\t}\n\t}\n\n\t// Validate and add valid gateways\n\tfor _, g := range options.gateways {\n\t\tmatch := false\n\t\tfor _, s := range options.subnets {\n\t\t\tok, err := subnetMatches(s, g.String())\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif !ok {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif iData[s].Gateway.IsValid() {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot configure multiple gateways (%s, %s) for the same subnet (%s)\", g, iData[s].Gateway, s)\n\t\t\t}\n\t\t\td := iData[s]","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/network/create.go#L171-L207","documentation":"Returned by `createIPAMConfig` (network/create.go:188-190) when an `--ip-range` value does not fall within ANY declared `--subnet`. Each ip-range must be contained by a subnet so the IPAM model can correlate it; an unmatched range is rejected. The message names the offending range.","triggerScenarios":"Running `docker network create --subnet 172.20.0.0/16 --ip-range 192.168.1.0/24 net` — the range is in a different network than the subnet.","commonSituations":"Typo in the range CIDR, forgetting to add the enclosing --subnet, or mismatched address families (IPv6 range with IPv4 subnet).","solutions":["Ensure every --ip-range is a subset of some declared --subnet.","Add a --subnet that contains the range, or fix the range CIDR.","Check address family consistency (don't mix IPv4 ranges with IPv6 subnets).","Count: there must be at least as many --subnet values as --ip-range values."],"exampleFix":"# before\ndocker network create --subnet 172.20.0.0/16 --ip-range 192.168.1.0/24 net\n# after\ndocker network create --subnet 172.20.0.0/16 --ip-range 172.20.5.0/24 net","handlingStrategy":"validation","validationCode":"// ensure every ip-range is contained by some subnet\nfor _, r := range ipRanges {\n    matched := false\n    for _, s := range subnets {\n        ok, _ := subnetMatches(s, r.String())\n        if ok { matched = true; break }\n    }\n    if !matched { return fmt.Errorf(\"ip-range %s not within any --subnet\", r) }\n}","typeGuard":null,"tryCatchPattern":"if err := runCreate(ctx, c, out, options); err != nil {\n    if strings.Contains(err.Error(), \"no matching subnet for range\") {\n        return fmt.Errorf(\"%w — add a --subnet that contains the range\", err)\n    }\n    return err\n}","preventionTips":["Provide a --subnet that encloses every --ip-range.","Match address families (IPv4 range with IPv4 subnet).","Keep the count of --subnet >= count of --ip-range."],"tags":["network","ipam","subnet","ip-range","validation","docker-cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}