{"record":{"id":"33ba03550b137051","repo":"dagger/dagger","slug":"cannot-set-both-nonetwork-and-hostnetwork","errorCode":null,"errorMessage":"cannot set both noNetwork and hostNetwork","messagePattern":"cannot set both noNetwork and hostNetwork","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/container_exec.go","lineNumber":364,"sourceCode":"\tif netMode != pb.NetMode_UNSET {\n\t\tmetaSpec.NetMode = netMode\n\t}\n\n\tmetaSpec.Env = addDefaultEnvvar(metaSpec.Env, \"PATH\", utilsystem.DefaultPathEnv(platform.OS))\n\tif includeVolatileEnv {\n\t\tmetaSpec.Env = mergeEnv(metaSpec.Env, container.VolatileEnv)\n\t}\n\n\tif opts.Expect != ReturnSuccess {\n\t\tmetaSpec.ValidExitCodes = opts.Expect.ReturnCodes()\n\t}\n\n\treturn &metaSpec, nil\n}\n\nfunc execNetMode(opts ContainerExecOpts) (pb.NetMode, error) {\n\tif opts.NoNetwork && opts.HostNetwork {\n\t\treturn pb.NetMode_UNSET, fmt.Errorf(\"cannot set both noNetwork and hostNetwork\")\n\t}\n\tif opts.NoNetwork {\n\t\treturn pb.NetMode_NONE, nil\n\t}\n\tif opts.HostNetwork {\n\t\treturn pb.NetMode_HOST, nil\n\t}\n\treturn pb.NetMode_UNSET, nil\n}\n\ntype serviceBindingExitError struct {\n\tbinding ServiceBinding\n\terr     error\n\t// origins are the install-span contexts of the API calls that returned the\n\t// bound service. Embedded in the error message as traceparents so the\n\t// consuming exec span links its failure back to those API calls.\n\torigins []trace.SpanContext\n}","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/core/container_exec.go#L346-L382","documentation":"An exec cannot simultaneously disable networking entirely (noNetwork) and use the host's network namespace (hostNetwork); the two options are mutually exclusive. execNetMode validates this up front and rejects the combination. Dagger maps each option to a distinct pb.NetMode.","triggerScenarios":"Calling ctr.WithExec with exec options where both NoNetwork:true and HostNetwork:true are set, e.g. via the low-level exec opts or a custom SDK passing both flags.","commonSituations":"Copy-pasting exec option structs, merging default options with user options where each set a different network flag, or porting code between APIs that used separate containers for these modes.","solutions":["Set only one of noNetwork or hostNetwork to true","If both behaviors are desired, choose the appropriate one (hostNetwork implies full network access, so it supersedes noNetwork)","Audit option-merging code so defaults do not leak a conflicting network flag"],"exampleFix":"// before\nContainerExecOpts{NoNetwork: true, HostNetwork: true}\n// after\nContainerExecOpts{HostNetwork: true} // or NoNetwork: true, not both","handlingStrategy":"validation","validationCode":"if opts.NoNetwork && opts.HostNetwork { return errors.New(\"choose either noNetwork or hostNetwork\") }","typeGuard":"func netOptsValid(o ContainerExecOpts) bool { return !(o.NoNetwork && o.HostNetwork) }","tryCatchPattern":null,"preventionTips":["Set at most one network flag per exec","Check merged option structs for conflicting defaults","Prefer hostNetwork when full access is needed"],"tags":["network","dagger","validation","exec"],"backgroundTag":"conflicting-options","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}