{"record":{"id":"4357c1c18bef1f5c","repo":"docker/cli","slug":"multiple-overlapping-subnet-configuration-is-not-s","errorCode":null,"errorMessage":"multiple overlapping subnet configuration is not supported","messagePattern":"multiple overlapping subnet configuration is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/network/create.go","lineNumber":157,"sourceCode":"func createIPAMConfig(options ipamOptions) (*network.IPAM, error) {\n\tif len(options.subnets) < len(options.ipRanges) || len(options.subnets) < len(options.gateways) {\n\t\treturn nil, errors.New(\"every ip-range or gateway must have a corresponding subnet\")\n\t}\n\tiData := map[string]*network.IPAMConfig{}\n\n\t// Populate non-overlapping subnets into consolidation map\n\tfor _, s := range options.subnets {\n\t\tfor k := range iData {\n\t\t\tok1, err := subnetMatches(s, k)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tok2, err := subnetMatches(k, s)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif ok1 || ok2 {\n\t\t\t\treturn nil, errors.New(\"multiple overlapping subnet configuration is not supported\")\n\t\t\t}\n\t\t}\n\t\tsn, err := netip.ParsePrefix(s)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tiData[s] = &network.IPAMConfig{Subnet: sn, AuxAddress: map[string]netip.Addr{}}\n\t}\n\n\t// Validate and add valid ip ranges\n\tfor _, r := range options.ipRanges {\n\t\tmatch := false\n\t\tfor _, s := range options.subnets {\n\t\t\tok, err := subnetMatches(s, r.String())\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif !ok {","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/network/create.go#L139-L175","documentation":"Thrown by createIPAMConfig while populating subnets into the consolidation map. Each new subnet is compared against all previously added subnets via subnetMatches (bidirectional CIDR containment check at lines 148-156). If any two subnets overlap (one contains the other), the error fires because Docker's IPAM consolidation does not support overlapping CIDR ranges.","triggerScenarios":"Running 'docker network create' with two --subnet flags whose CIDR blocks overlap, e.g. '--subnet 172.20.0.0/16 --subnet 172.20.1.0/24' where the /24 falls entirely inside the /16.","commonSituations":"Specifying a broad /16 plus a narrower /24 within it; copy-pasting subnet ranges from different configs that happen to nest; mixing IPv4 and IPv6 ranges carelessly.","solutions":["Use mutually exclusive, non-overlapping CIDR blocks for each --subnet.","Verify with a subnet calculator that no specified range is contained within another.","Consolidate overlapping ranges into a single --subnet."],"exampleFix":"# before\ndocker network create --subnet 172.20.0.0/16 --subnet 172.20.1.0/24 mynet\n# after\ndocker network create --subnet 172.20.0.0/16 --subnet 172.21.0.0/16 mynet","handlingStrategy":"validation","validationCode":"// Pre-check subnets for overlap using netip before network create\nfunc checkSubnetOverlap(subnets []string) error {\n    var prefixes []netip.Prefix\n    for _, s := range subnets {\n        p, err := netip.ParsePrefix(s)\n        if err != nil { return err }\n        for _, q := range prefixes {\n            if p.Overlaps(q) || q.Overlaps(p) {\n                return fmt.Errorf(\"subnets %s and %s overlap\", p, q)\n            }\n        }\n        prefixes = append(prefixes, p)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Plan CIDR ranges so no block nests inside another.","Use a subnet calculator or netip.Prefix.Overlaps in preflight checks.","Document each network's subnet allocation to avoid accidental reuse."],"tags":["network","ipam","docker","go","cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}