{"record":{"id":"3ce5bee9fc4b810e","repo":"docker/cli","slug":"invalid-subnet-w","errorCode":null,"errorMessage":"invalid subnet: %w","messagePattern":"invalid subnet: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/network/create.go","lineNumber":259,"sourceCode":"\n\tidl := make([]network.IPAMConfig, 0, len(iData))\n\tfor _, v := range iData {\n\t\tidl = append(idl, *v)\n\t}\n\n\treturn &network.IPAM{\n\t\tDriver:  options.driver,\n\t\tConfig:  idl,\n\t\tOptions: options.driverOpts.GetAll(),\n\t}, nil\n}\n\nfunc subnetMatches(subnet, data string) (bool, error) {\n\tvar ip net.IP\n\n\t_, s, err := net.ParseCIDR(subnet)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"invalid subnet: %w\", err)\n\t}\n\n\tif strings.Contains(data, \"/\") {\n\t\tip, _, err = net.ParseCIDR(data)\n\t\tif err != nil {\n\t\t\treturn false, err\n\t\t}\n\t} else {\n\t\tip = net.ParseIP(data)\n\t}\n\n\treturn s.Contains(ip), nil\n}\n","sourceCodeStart":241,"sourceCodeEnd":273,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/network/create.go#L241-L273","documentation":"Returned by subnetMatches (create.go:259) when net.ParseCIDR fails on a subnet string. It wraps the underlying parse error with %w so callers see both the reason and the failing value context. This function is invoked for every subnet/range/gateway/aux-address comparison, so any malformed CIDR anywhere in the IPAM flags surfaces here.","triggerScenarios":"Passing a --subnet that is not valid CIDR notation: missing prefix length (`172.20.0.0`), bad octets (`172.300.0.0/16`), or non-IP text (`foo`). Also triggered by a --ip-range or --gateway string that subnetMatches is asked to interpret as a CIDR.","commonSituations":"Omitting the `/prefix`, typos in IP octets, trailing whitespace from a shell variable, or templating a subnet from a config that left it blank.","solutions":["Provide the subnet in full CIDR form, e.g. 172.20.0.0/16.","Strip whitespace/newlines from dynamically supplied subnet values.","Validate the string with netip.ParsePrefix before passing it to the command."],"exampleFix":"// before\ndocker network create --subnet 172.20.0.0 net\n// after\ndocker network create --subnet 172.20.0.0/16 net","handlingStrategy":"validation","validationCode":"// Reject malformed CIDRs before they reach subnetMatches.\nfunc validateCIDRs(subnets []string) error {\n    for _, s := range subnets {\n        if _, _, err := net.ParseCIDR(s); err != nil {\n            return fmt.Errorf(\"invalid subnet %q: %w\", s, err)\n        }\n    }\n    return nil\n}","typeGuard":"// isCIDR narrows a string to a valid CIDR form.\nfunc isCIDR(s string) bool {\n    _, _, err := net.ParseCIDR(s)\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Always include the /prefix in subnet strings.","Trim whitespace from templated/env-derived subnet values.","Parse with netip.ParsePrefix early in config loaders."],"tags":["network","ipam","subnet","cidr","docker-cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}