{"record":{"id":"3f91d97fc65d3a6b","repo":"docker/cli","slug":"userns-invalid-user-mode","errorCode":null,"errorMessage":"--userns: invalid USER mode","messagePattern":"--userns: invalid USER mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":530,"sourceCode":"\t// collect all the labels for the container\n\tlabels, err := opts.ReadKVStrings(copts.labelsFile.GetSlice(), copts.labels.GetSlice())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"--label-file: %w\", err)\n\t}\n\n\tpidMode := container.PidMode(copts.pidMode)\n\tif !pidMode.Valid() {\n\t\treturn nil, errors.New(\"--pid: invalid PID mode\")\n\t}\n\n\tutsMode := container.UTSMode(copts.utsMode)\n\tif !utsMode.Valid() {\n\t\treturn nil, errors.New(\"--uts: invalid UTS mode\")\n\t}\n\n\tusernsMode := container.UsernsMode(copts.usernsMode)\n\tif !usernsMode.Valid() {\n\t\treturn nil, errors.New(\"--userns: invalid USER mode\")\n\t}\n\n\tcgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)\n\tif !cgroupnsMode.Valid() {\n\t\treturn nil, errors.New(\"--cgroupns: invalid CGROUP mode\")\n\t}\n\n\trestartPolicy, err := opts.ParseRestartPolicy(copts.restartPolicy)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tloggingOpts, err := parseLoggingOpts(copts.loggingDriver, copts.loggingOpts.GetSlice())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsecurityOpts, err := parseSecurityOpts(copts.securityOpt.GetSlice())","sourceCodeStart":512,"sourceCodeEnd":548,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/opts.go#L512-L548","documentation":"Returned when the value passed to --userns fails container.UsernsMode.Valid() (opts.go:528-531). Valid user-namespace modes are the empty string (default, which honors the daemon's user-namespace remap config) or \"host\" (run in the host user namespace, disabling remap). Any other keyword is rejected.","triggerScenarios":"Running `docker run --userns=<bad> ...` with a value that is neither empty nor \"host\". For example `--userns=private`, `--userns=remap`, `--userns=container:foo`.","commonSituations":"Confusing --userns with other namespace flags that accept container:<id>; assuming a named remap profile can be selected here (it cannot -- remapping is configured daemon-side); typos.","solutions":["Use `--userns=host` to disable user-namespace remapping for this container.","Omit the flag to use the daemon's default user-namespace mode.","Do not attempt container:<id> or named-profile values with --userns."],"exampleFix":"// before\ndocker run --userns=remap myimage\n// after\ndocker run --userns=host myimage","handlingStrategy":"validation","validationCode":"if un := container.UsernsMode(copts.usernsMode); !un.Valid() {\n    return fmt.Errorf(\"--userns: invalid USER mode %q\", copts.usernsMode)\n}","typeGuard":"// isValidUsernsMode narrows acceptable --userns values.\nfunc isValidUsernsMode(s string) bool {\n    return s == \"\" || s == \"host\"\n}","tryCatchPattern":null,"preventionTips":["Only empty and host are valid for --userns; named remap profiles are daemon-side.","Do not reuse container:<id> syntax from --pid/--ipc.","Validate flag input in wrapper scripts."],"tags":["docker-cli","user-namespace","validation","namespace","container-create"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}