{"record":{"id":"43f87ea00ec7f85e","repo":"Tencent/WeKnora","slug":"sandbox-docker-unix-socket-path-q-must-be-absolu","errorCode":null,"errorMessage":"sandbox: docker unix socket path %q must be absolute","messagePattern":"sandbox: docker unix socket path %q must be absolute","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/docker_engine.go","lineNumber":272,"sourceCode":"//\n// A TCP endpoint gets the same outbound treatment as any other workspace-\n// supplied URL: a daemon socket accepts container creation, so an admin who\n// can point it anywhere can make WeKnora talk to an arbitrary internal\n// service. Unix sockets are local by definition and only have to be absolute.\nfunc ValidateDockerHost(host string, allowPrivate bool) error {\n\ttrimmed := strings.TrimSpace(host)\n\tif trimmed == \"\" {\n\t\treturn nil\n\t}\n\tscheme, address, found := strings.Cut(trimmed, \"://\")\n\tif !found {\n\t\treturn fmt.Errorf(\n\t\t\t\"sandbox: docker host %q must include a scheme (unix:// or tcp://)\", host)\n\t}\n\tswitch strings.ToLower(scheme) {\n\tcase \"unix\":\n\t\tif !strings.HasPrefix(address, \"/\") {\n\t\t\treturn fmt.Errorf(\"sandbox: docker unix socket path %q must be absolute\", address)\n\t\t}\n\t\treturn nil\n\tcase \"tcp\", \"http\", \"https\":\n\t\t// The guard speaks HTTP; the daemon's TCP endpoint is an HTTP\n\t\t// endpoint, so the check is the same one every other backend gets.\n\t\treturn ValidateOutboundURLWithPolicy(\n\t\t\t\"http://\"+address, OutboundURLPolicy{AllowPrivate: allowPrivate},\n\t\t)\n\tdefault:\n\t\treturn fmt.Errorf(\"sandbox: unsupported docker host scheme %q\", scheme)\n\t}\n}\n\n// ValidateDockerRemoteTLS requires client certificates for a TCP daemon.\n// A remote Engine API that accepts container creation is a root shell on\n// that host; plaintext tcp://2375 is not an acceptable way to reach it.\n// Unix sockets are local to the WeKnora process and do not use TLS.\nfunc ValidateDockerRemoteTLS(host, tlsCertPath string) error {","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/docker_engine.go#L254-L290","documentation":"ValidateDockerHost accepts a unix:// scheme but requires the address portion to be an absolute filesystem path starting with '/'. A relative path like unix://docker.sock or unix://run/docker.sock cannot be resolved reliably by the Docker client, so this error is thrown.","triggerScenarios":"Configuring a docker host as unix:// followed by a relative path — e.g. \"unix://docker.sock\", \"unix://./sock\", \"unix://run/docker.sock\" — then calling ResolveEffectiveConfig or TestValidateDockerHost.","commonSituations":"Writing unix://docker.sock by analogy with URLs where the host segment is omitted; environments where the daemon socket lives at a custom path and only the filename was configured; confusion between URL host/path semantics and filesystem paths.","solutions":["Use a full absolute path: unix:///var/run/docker.sock (note the three slashes: empty host + absolute path)","Resolve the socket path with an absolute reference, e.g. filepath.Join to an absolute base before formatting the host string","Verify the socket file exists and is readable at that absolute path","If intending a remote daemon, switch to tcp://host:port instead of unix://"],"exampleFix":"// before\nHost: \"unix://docker.sock\"\n// after\nHost: \"unix:///var/run/docker.sock\"","handlingStrategy":"validation","validationCode":"if strings.HasPrefix(strings.ToLower(strings.TrimSpace(cfg.Docker.Host)), \"unix://\") {\n    addr := strings.TrimPrefix(strings.TrimSpace(cfg.Docker.Host), \"unix://\")\n    if !strings.HasPrefix(addr, \"/\") { return fmt.Errorf(\"unix socket path must be absolute: %q\", addr) }\n}","typeGuard":"func isAbsoluteUnixSocketHost(host string) bool {\n    _, addr, found := strings.Cut(strings.TrimSpace(host), \"://\")\n    return found && strings.HasPrefix(addr, \"/\")\n}","tryCatchPattern":"if err := sandbox.ValidateDockerHost(cfg.Docker.Host, allowPrivate); err != nil {\n    if strings.Contains(err.Error(), \"must be absolute\") { /* fix path to leading-slash absolute form */ }\n    return err\n}","preventionTips":["Remember the three-slash form: unix:///var/run/docker.sock (empty host + absolute path)","Build socket paths with filepath.Abs before formatting the host string","Verify the socket file exists at the absolute path on the host running the guard"],"tags":["sandbox","docker","configuration","url-validation"],"backgroundTag":"missing-url-scheme","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}