{"record":{"id":"35345089aaf2c661","repo":"docker/cli","slug":"cgroupns-invalid-cgroup-mode","errorCode":null,"errorMessage":"--cgroupns: invalid CGROUP mode","messagePattern":"--cgroupns: invalid CGROUP mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":535,"sourceCode":"\n\tpidMode := container.PidMode(copts.pidMode)\n\tif !pidMode.Valid() {\n\t\treturn nil, errors.New(\"--pid: invalid PID mode\")\n\t}\n\n\tutsMode := container.UTSMode(copts.utsMode)\n\tif !utsMode.Valid() {\n\t\treturn nil, errors.New(\"--uts: invalid UTS mode\")\n\t}\n\n\tusernsMode := container.UsernsMode(copts.usernsMode)\n\tif !usernsMode.Valid() {\n\t\treturn nil, errors.New(\"--userns: invalid USER mode\")\n\t}\n\n\tcgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)\n\tif !cgroupnsMode.Valid() {\n\t\treturn nil, errors.New(\"--cgroupns: invalid CGROUP mode\")\n\t}\n\n\trestartPolicy, err := opts.ParseRestartPolicy(copts.restartPolicy)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tloggingOpts, err := parseLoggingOpts(copts.loggingDriver, copts.loggingOpts.GetSlice())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsecurityOpts, err := parseSecurityOpts(copts.securityOpt.GetSlice())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsecurityOpts, maskedPaths, readonlyPaths := parseSystemPaths(securityOpts)","sourceCodeStart":517,"sourceCodeEnd":553,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/opts.go#L517-L553","documentation":"Returned when the value passed to --cgroupns fails container.CgroupnsMode.Valid() (opts.go:533-536). Valid values are empty (use the daemon default-cgroupns-mode), \"host\" (run in the host cgroup namespace), or \"private\" (run in a private cgroup namespace). The flag requires API version >= 1.41. Any other value is rejected.","triggerScenarios":"Running `docker run --cgroupns=<bad> ...` with a value other than empty, \"host\", or \"private\". For example `--cgroupns=container:foo`, `--cgroupns=none`, `--cgroupns=shared`.","commonSituations":"Using container:<id> syntax (unsupported for cgroupns); guessing keywords like \"none\"/\"shared\"; running against a daemon older than 1.41 that ignores or mishandles the flag.","solutions":["Use `--cgroupns=host` or `--cgroupns=private` explicitly.","Omit the flag to inherit the daemon's default-cgroupns-mode.","Ensure the daemon supports API version 1.41+ (check `docker version`)."],"exampleFix":"// before\ndocker run --cgroupns=shared myimage\n// after\ndocker run --cgroupns=private myimage","handlingStrategy":"validation","validationCode":"if cm := container.CgroupnsMode(copts.cgroupnsMode); !cm.Valid() {\n    return fmt.Errorf(\"--cgroupns: invalid CGROUP mode %q\", copts.cgroupnsMode)\n}","typeGuard":"// isValidCgroupnsMode narrows acceptable --cgroupns values.\nfunc isValidCgroupnsMode(s string) bool {\n    return s == \"\" || s == \"host\" || s == \"private\"\n}","tryCatchPattern":null,"preventionTips":["Restrict values to empty, host, private.","Verify daemon API >= 1.41 (`docker version`) before relying on the flag.","Reject container:<id> and guessed keywords in validators."],"tags":["docker-cli","cgroup-namespace","validation","namespace","container-create","api-version"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}