{"record":{"id":"61d13e6691723d06","repo":"docker/cli","slug":"invalid-mode-specified-v-61d13e","errorCode":null,"errorMessage":"invalid mode specified: %v","messagePattern":"invalid mode specified: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/swarmopts/secret.go","lineNumber":61,"sourceCode":"\tfor _, field := range fields {\n\t\tkey, val, ok := strings.Cut(field, \"=\")\n\t\tif !ok || key == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid field '%s' must be a key=value pair\", field)\n\t\t}\n\t\t// TODO(thaJeztah): these options should not be case-insensitive.\n\t\tswitch strings.ToLower(key) {\n\t\tcase \"source\", \"src\":\n\t\t\toptions.SecretName = val\n\t\tcase \"target\":\n\t\t\toptions.File.Name = val\n\t\tcase \"uid\":\n\t\t\toptions.File.UID = val\n\t\tcase \"gid\":\n\t\t\toptions.File.GID = val\n\t\tcase \"mode\":\n\t\t\tm, err := strconv.ParseUint(val, 0, 32)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid mode specified: %v\", err)\n\t\t\t}\n\n\t\t\toptions.File.Mode = os.FileMode(m)\n\t\tdefault:\n\t\t\treturn errors.New(\"invalid field in secret request: \" + key)\n\t\t}\n\t}\n\n\tif options.SecretName == \"\" {\n\t\treturn errors.New(\"source is required\")\n\t}\n\tif options.File.Name == \"\" {\n\t\toptions.File.Name = options.SecretName\n\t}\n\n\to.values = append(o.values, options)\n\treturn nil\n}","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/opts/swarmopts/secret.go#L43-L79","documentation":"Thrown by swarmopts.SecretOpt.Set when the 'mode=<value>' field of a --secret / --secret-add secret reference cannot be parsed as a 32-bit unsigned integer. The value is parsed with strconv.ParseUint(val, 0, 32): base 0 means an unprefixed number is treated as DECIMAL, while '0o444' (octal), '0x..' (hex), or a legacy leading-zero '0444' are honored. Anything non-numeric, negative, or exceeding 2^32-1 fails here.","triggerScenarios":"Running 'docker service create --secret source=db,mode=444' and expecting octal r--r--r-- (base 0 reads unprefixed '444' as decimal 444 = 0o674, which technically succeeds but is not what was meant). It HARD-fails on 'mode=r--r--r--', 'mode=444x', 'mode=-1', or 'mode=5000000000' (uint32 overflow).","commonSituations":"Users assume shell chmod-style octal/symbolic notation (e.g. 'mode=444' or 'mode=u=rw') like 'chmod'; copying a mode from a Dockerfile that used JSON '0444'; or passing a file mode larger than uint32. The base-0 quirk silently surprises anyone who expects unprefixed digits to be octal.","solutions":["Prefix octal modes with 0o (Go base-0 octal): use 'mode=0o444' instead of 'mode=444'.","If you really mean decimal, keep the integer in range 0..4294967295 (e.g. 'mode=292' for 0o444).","Do not use symbolic chmod notation (rwx, u=rw); convert it to a numeric mode first with a umask/chmod tool."],"exampleFix":"# before\ndocker service create --secret source=db,mode=444\n# after\n# 0o prefix => base-0 parses octal => 0o444 == r--r--r--\ndocker service create --secret source=db,mode=0o444","handlingStrategy":"validation","validationCode":"// Validate the mode= field of a --secret value (Go base-0 semantics) BEFORE calling SecretOpt.Set.\nimport (\"strconv\"; \"strings\")\n\nfunc validSecretMode(opt string) bool {\n    for _, f := range strings.Split(opt, \",\") {\n        k, v, ok := strings.Cut(f, \"=\")\n        if !ok || !strings.EqualFold(strings.TrimSpace(k), \"mode\") {\n            continue\n        }\n        _, err := strconv.ParseUint(strings.TrimSpace(v), 0, 32) // base 0, 32-bit, like opts\n        return err == nil\n    }\n    return true // no mode field -> default 0o444\n}\n\n// usage:\n// if !validSecretMode(input) { return fmt.Errorf(\"bad secret mode: %s\", input) }","typeGuard":null,"tryCatchPattern":"// secretOpt is a pflag.Value; Set returns the error directly.\nif err := secretOpt.Set(input); err != nil {\n    // err already contains: invalid mode specified: <strconv error>\n    return fmt.Errorf(\"invalid --secret value %q: %w\", input, err)\n}","preventionTips":["Always write secret modes with the 0o octal prefix (mode=0o444) to avoid the base-0 decimal trap.","Never pass symbolic chmod notation (u=rw, rwx).","Keep modes within uint32 (0..4294967295)."],"tags":["docker","swarm","secrets","permissions","cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}