{"record":{"id":"896aab0af8d33d8e","repo":"coleam00/Archon","slug":"provider-provider-cannot-run-inside-a-contain","errorCode":null,"errorMessage":"Provider '${provider}' cannot run inside a container yet (containerExec capability). Use provider claude, or run without --container.","messagePattern":"Provider '(.+?)' cannot run inside a container yet \\(containerExec capability\\)\\. Use provider claude, or run without --container\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/workflows/src/dag-executor.ts","lineNumber":1761,"sourceCode":"  // decided it keeps no node-level form, making it the single workflow-level\n  // field with no per-node counterpart. There is deliberately no\n  // ProviderCapabilities axis for one provider's one field.\n  //\n  // Reasoning depth is NOT in this category any more: the loader translates the\n  // deprecated `modelReasoningEffort:` into `effort:`, so the executor sees one\n  // provider-agnostic field and needs no Codex branch for it.\n  const isCodex = provider === 'codex';\n\n  // The one reasoning depth this node will run at, before any preset fallback.\n  const declaredEffort = resolution.declaredEffort;\n\n  // Runtime backstop for container dispatch: the run-start pre-scan\n  // (collectContainerIncompatibleProviders) hand-mirrors this same provider\n  // resolution, so it could drift. Re-check the RESOLVED provider here, at the\n  // actual dispatch point, so a container turn can never reach a provider that\n  // can't honor it — no silent host downgrade (defense in depth).\n  if (execContext.kind === 'container' && !caps.containerExec) {\n    throw new Error(\n      `Provider '${provider}' cannot run inside a container yet (containerExec ` +\n        'capability). Use provider claude, or run without --container.'\n    );\n  }\n\n  // Capability warnings — inform users when features are unsupported\n  const capChecks: [string, keyof ProviderCapabilities, boolean][] = [\n    [\n      'allowed_tools/denied_tools',\n      'toolRestrictions',\n      node.allowed_tools !== undefined || node.denied_tools !== undefined,\n    ],\n    ['hooks', 'hooks', node.hooks !== undefined],\n    ['mcp', 'mcp', node.mcp !== undefined],\n    ['skills', 'skills', node.skills !== undefined && node.skills.length > 0],\n    ['agents', 'agents', node.agents !== undefined],\n    ['effort', 'effortControl', declaredEffort !== undefined],\n    ['thinking', 'thinkingControl', (node.thinking ?? workflowLevelOptions.thinking) !== undefined],","sourceCodeStart":1743,"sourceCodeEnd":1779,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/workflows/src/dag-executor.ts#L1743-L1779","documentation":"A runtime backstop in the DAG executor: when a node turn is dispatched into a container (execContext.kind === 'container') but the resolved provider lacks the containerExec capability, the executor throws instead of silently downgrading the turn to the host. This is defense in depth alongside the run-start pre-scan, which hand-mirrors provider resolution and could drift.","triggerScenarios":"Running with --container (or container exec context) while a node's resolved provider is one whose capabilities do not include containerExec — e.g. any provider other than claude under current capability tables.","commonSituations":"Mixing --container with a multi-provider workflow where one node uses a non-container-capable provider; the run-start pre-scan missed the node because resolution differed (drift) and this backstop fires at dispatch.","solutions":["Switch that node's provider to claude (the container-capable provider).","Run without --container so nodes execute on the host.","Remove/adjust the provider on container-dispatched nodes, or wait for the provider to gain containerExec support.","If you believe the capability table is wrong, verify the provider's declared capabilities in the providers package."],"exampleFix":"// before\narchon run workflow.yaml --container   # node uses provider: codex\n// after\nprovider: \"claude\"   # or drop --container","handlingStrategy":"validation","validationCode":"if (runOpts.container && node.provider !== 'claude') {\n  throw new Error(`Provider '${node.provider}' lacks containerExec; use claude or drop --container`);\n}","typeGuard":"function supportsContainer(p: ProviderId, caps: ProviderCapabilities): boolean {\n  return caps.containerExec === true;\n}","tryCatchPattern":"try {\n  await runWorkflow(wf, { container: true });\n} catch (e) {\n  if (String(e).includes('cannot run inside a container')) console.error('Use claude or run without --container');\n  else throw e;\n}","preventionTips":["Check the provider capability table before enabling --container.","Keep container and host dispatch node sets separate in workflow design.","Re-verify capabilities after provider upgrades."],"tags":["container","provider","capability"],"backgroundTag":"unsupported-provider-capability","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}