{"record":{"id":"76f76b8b4d743525","repo":"docker/cli","slug":"sysctl-s-is-not-allowed","errorCode":null,"errorMessage":"sysctl '%s' is not allowed","messagePattern":"sysctl '(.+?)' is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/opts.go","lineNumber":269,"sourceCode":"// ValidateSysctl validates a sysctl and returns it.\nfunc ValidateSysctl(val string) (string, error) {\n\tvalidSysctlMap := map[string]bool{\n\t\t\"kernel.msgmax\":          true,\n\t\t\"kernel.msgmnb\":          true,\n\t\t\"kernel.msgmni\":          true,\n\t\t\"kernel.sem\":             true,\n\t\t\"kernel.shmall\":          true,\n\t\t\"kernel.shmmax\":          true,\n\t\t\"kernel.shmmni\":          true,\n\t\t\"kernel.shm_rmid_forced\": true,\n\t}\n\tvalidSysctlPrefixes := []string{\n\t\t\"net.\",\n\t\t\"fs.mqueue.\",\n\t}\n\tk, _, ok := strings.Cut(val, \"=\")\n\tif !ok || k == \"\" {\n\t\treturn \"\", fmt.Errorf(\"sysctl '%s' is not allowed\", val)\n\t}\n\tif validSysctlMap[k] {\n\t\treturn val, nil\n\t}\n\tfor _, vp := range validSysctlPrefixes {\n\t\tif strings.HasPrefix(k, vp) {\n\t\t\treturn val, nil\n\t\t}\n\t}\n\treturn \"\", fmt.Errorf(\"sysctl '%s' is not allowed\", val)\n}\n\n// FilterOpt is a flag type for validating filters\ntype FilterOpt struct {\n\tfilter client.Filters\n}\n\n// NewFilterOpt returns a new FilterOpt","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/opts/opts.go#L251-L287","documentation":"Thrown by ValidateSysctl (opts.go:269) when the input has no '=' separator or the key portion is empty. Docker restricts container sysctls to a known-safe allowlist and prefixes; before that check even runs, the value must be in `key=value` form. Without a key there is nothing to allow, so it is reported as 'not allowed'.","triggerScenarios":"Calling ValidateSysctl with a bare name like `net.ipv4.ip_forward` (no '=value'), an empty string, or `=value` (empty key). strings.Cut at line 267 returns ok=false or k=\"\", triggering line 269.","commonSituations":"Passing just the sysctl name without its value (`--sysctl net.ipv4.ip_forward` instead of `--sysctl net.ipv4.ip_forward=1`), dropping the '=' during templating, or passing a value-only string.","solutions":["Always pass sysctls as `name=value`, e.g. `--sysctl net.ipv4.ip_forward=1`.","Confirm the string contains exactly one '=' with a non-empty left side before submitting.","When generating sysctl flags from a map, format each entry as `k + \"=\" + fmt.Sprint(v)`.","Check for accidental trailing '=' with an empty value (key is fine but verify intent)."],"exampleFix":"// before\n--sysctl net.ipv4.ip_forward\n// after\n--sysctl net.ipv4.ip_forward=1","handlingStrategy":"validation","validationCode":"// Ensure sysctl is key=value with non-empty key before validation.\nif k, _, ok := strings.Cut(sysctl, \"=\"); !ok || k == \"\" {\n    return fmt.Errorf(\"sysctl %q must be name=value\", sysctl)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write sysctls as name=value.","When expanding maps, format each entry explicitly.","Reject bare names early in your wrapper.","Treat a missing '=' as a usage error, not a default."],"tags":["docker","sysctl","validation","cli","kernel"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}