{"record":{"id":"4fef627e558b2bc8","repo":"Tencent/WeKnora","slug":"sandbox-docker-network-mode-q-is-not-allowed-us","errorCode":null,"errorMessage":"sandbox: docker network mode %q is not allowed; use \"bridge\" or \"none\"","messagePattern":"sandbox: docker network mode %q is not allowed; use \"bridge\" or \"none\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/docker_engine.go","lineNumber":328,"sourceCode":"//\n// host and container: modes share another namespace outright, which would put\n// sandbox code on the WeKnora host's or a sibling container's network. A\n// user-defined network name is refused for the weaker but equally real version\n// of the same problem: the usual deployment reaches its daemon through the\n// mounted docker.sock, so naming the deployment's own compose network would\n// place a sandbox on the same L3 network as Postgres and Redis. Only the\n// operator can judge what a given named network exposes, and this value is set\n// per workspace config, so it is not theirs to choose.\nfunc ValidateDockerNetworkMode(mode string) error {\n\ttrimmed := strings.TrimSpace(mode)\n\tif trimmed == \"\" {\n\t\treturn nil\n\t}\n\tswitch strings.ToLower(trimmed) {\n\tcase \"bridge\", \"none\":\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\n\t\t\"sandbox: docker network mode %q is not allowed; use \\\"bridge\\\" or \\\"none\\\"\",\n\t\tmode)\n}\n\n// dockerErrorKind classifies an Engine API error. The moby client tags its\n// errors with containerd's errdefs, which is a far more reliable signal than\n// the message text.\nfunc dockerErrorKind(op string, err error) RemoteErrorKind {\n\tswitch {\n\tcase err == nil:\n\t\treturn \"\"\n\tcase errors.Is(err, context.DeadlineExceeded), cerrdefs.IsDeadlineExceeded(err):\n\t\treturn RemoteErrorKindTimeout\n\tcase cerrdefs.IsNotFound(err):\n\t\t// A missing image on create is a bad template, not a vanished sandbox:\n\t\t// classifying it as NotFound would tell the lifecycle it may rebind.\n\t\tif op == \"Create\" {\n\t\t\treturn RemoteErrorKindInvalidRequest","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/docker_engine.go#L310-L346","documentation":"ValidateDockerNetworkMode restricts the docker network mode of sandbox containers to exactly \"bridge\" or \"none\" (case-insensitive). Any other mode — host, container:<id>, custom networks — is rejected to prevent sandboxed workloads from escaping isolation or reaching networks they should not see.","triggerScenarios":"Setting the sandbox docker network mode config field to \"host\", \"container:abc123\", a custom network name, or any value other than bridge/none, then calling ResolveEffectiveConfig, dockerSettingsFromConfig, or TestValidateDockerNetworkMode.","commonSituations":"Copying docker run --network host habits into sandbox config; pointing containers at an internal registry network by name; defaulting to host networking for performance reasons.","solutions":["Change the network mode to \"none\" for maximum isolation (add explicit DNS/DNS servers, e.g. cube DNS settings, if network access is needed)","Use \"bridge\" when the sandbox needs default outbound connectivity through Docker's bridge","Remove any custom network names or container: modes — they are not supported by policy","Note the comparison is case-insensitive; \"Bridge\" or \"NONE\" are accepted"],"exampleFix":"// before\nNetworkMode: \"host\"\n// after\nNetworkMode: \"none\" // or \"bridge\" if outbound access is required","handlingStrategy":"validation","validationCode":"mode := strings.ToLower(strings.TrimSpace(cfg.Docker.NetworkMode))\nif mode != \"\" && mode != \"bridge\" && mode != \"none\" {\n    return fmt.Errorf(\"network mode %q rejected; use bridge or none\", cfg.Docker.NetworkMode)\n}","typeGuard":"func isAllowedNetworkMode(mode string) bool {\n    switch strings.ToLower(strings.TrimSpace(mode)) { case \"\", \"bridge\", \"none\": return true }\n    return false\n}","tryCatchPattern":"if err := sandbox.ValidateDockerNetworkMode(cfg.Docker.NetworkMode); err != nil {\n    if strings.Contains(err.Error(), \"not allowed\") { cfg.Docker.NetworkMode = \"none\" }\n    return err\n}","preventionTips":["Only ever emit \"bridge\" or \"none\" from config generation code","Do not port --network host/container habits into sandbox configs — host networking defeats isolation","Add a config lint test asserting every shipped profile passes ValidateDockerNetworkMode"],"tags":["sandbox","docker","network","security","configuration"],"backgroundTag":"invalid-network-mode","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}