{"record":{"id":"5dfb12356a7092d8","repo":"docker/cli","slug":"got-a-device","errorCode":null,"errorMessage":"got a device","messagePattern":"got a device","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/utils.go","lineNumber":92,"sourceCode":"\t\t}\n\n\t\tif fileInfo.Mode().IsDir() || fileInfo.Mode().IsRegular() {\n\t\t\treturn nil\n\t\t}\n\n\t\tif err := ValidateOutputPathFileMode(fileInfo.Mode()); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid output path: %q must be a directory or a regular file: %w\", path, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// ValidateOutputPathFileMode validates the output paths of the \"docker cp\" command\n// and serves as a helper to [ValidateOutputPath]\nfunc ValidateOutputPathFileMode(fileMode os.FileMode) error {\n\tswitch {\n\tcase fileMode&os.ModeDevice != 0:\n\t\treturn errors.New(\"got a device\")\n\tcase fileMode&os.ModeIrregular != 0:\n\t\treturn errors.New(\"got an irregular file\")\n\t}\n\treturn nil\n}\n\nfunc invalidParameter(err error) error {\n\treturn invalidParameterErr{err}\n}\n\ntype invalidParameterErr struct{ error }\n\nfunc (invalidParameterErr) InvalidParameter() {}\n\nfunc notFound(err error) error {\n\treturn notFoundErr{err}\n}\n","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/utils.go#L74-L110","documentation":"Thrown by ValidateOutputPathFileMode (cli/command/utils.go:92) when the destination path of a `docker cp` resolves to a device file (os.ModeDevice bit set — block or character device). Copying onto a device is unsafe and meaningless, so output-path validation rejects it before any transfer.","triggerScenarios":"Running `docker cp <container>:/file /dev/sda1` or targeting any path under /dev that is a device node as the copy destination.","commonSituations":"Destination path accidentally resolves to /dev/something; a symlink resolves to a device; operator mis-types a path that lands on a device node.","solutions":["Use a regular file or directory as the destination.","If a special file is ultimately intended, copy to a normal path first then redirect/write separately.","Stat the destination before copying and reject non-regular, non-directory targets."],"exampleFix":"// before\ndocker cp web:/etc/nginx/nginx.conf /dev/sda1\n\n// after\ndocker cp web:/etc/nginx/nginx.conf ./nginx.conf","handlingStrategy":"validation","validationCode":"// Reject device destinations before docker cp.\nfi, err := os.Stat(dest)\nif err == nil {\n\tif fi.Mode()&os.ModeDevice != 0 {\n\t\treturn fmt.Errorf(\"destination %q is a device file\", dest)\n\t}\n}","typeGuard":"func isRegularOrDir(fm os.FileMode) bool {\n\treturn fm.IsRegular() || fm.IsDir()\n}","tryCatchPattern":null,"preventionTips":["Resolve destination symlinks and stat before copying.","Disallow /dev and other special paths in cp wrappers.","Prefer copying into a directory and symlinking if a special target is needed."],"tags":["docker","cp","filesystem","device","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}