{"record":{"id":"999e441e65c13644","repo":"docker/cli","slug":"query-parameters-are-not-allowed-q","errorCode":null,"errorMessage":"query parameters are not allowed: %q","messagePattern":"query parameters are not allowed: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/connhelper/ssh/ssh.go","lineNumber":64,"sourceCode":"\t\treturn nil, errors.New(\"incorrect scheme: \" + u.Scheme)\n\t}\n\n\tvar sp Spec\n\n\tif u.User != nil {\n\t\tsp.User = u.User.Username()\n\t\tif _, ok := u.User.Password(); ok {\n\t\t\treturn nil, errors.New(\"plain-text password is not supported\")\n\t\t}\n\t}\n\tsp.Host = u.Hostname()\n\tif sp.Host == \"\" {\n\t\treturn nil, errors.New(\"hostname is empty\")\n\t}\n\tsp.Port = u.Port()\n\tsp.Path = u.Path\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"query parameters are not allowed: %q\", u.RawQuery)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"fragments are not allowed: %q\", u.Fragment)\n\t}\n\n\treturn &sp, nil\n}\n\n// Spec of SSH URL\ntype Spec struct {\n\tUser string\n\tHost string\n\tPort string\n\tPath string\n}\n\n// Args returns args except \"ssh\" itself combined with optional additional\n// command and args to be executed on the remote host. It attempts to quote","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/connhelper/ssh/ssh.go#L46-L82","documentation":"Specific validation error from newSpec (ssh.go:63-64): the parsed ssh URL must not carry a query string. If u.RawQuery is non-empty, the raw query is echoed back and the Spec construction aborts. ssh connection options are not configurable via the URL.","triggerScenarios":"ssh.ParseURL or NewSpec receives a URL like `ssh://user@host?ConnectTimeout=10`. The presence of any `?...` triggers the error.","commonSituations":"A user tries to pass ssh options through the DOCKER_HOST URL (e.g. `?IdentityFile=...`, `?StrictHostKeyChecking=no`), which is unsupported. SSH options must be set via the normal ssh config / known_hosts / GetConnectionHelperWithSSHOpts flags, not the URL.","solutions":["Remove the query string from the DOCKER_HOST ssh URL.","Configure ssh options in `~/.ssh/config` instead (e.g. a Host block with IdentityFile, ConnectTimeout).","If invoking the helper programmatically, pass extra ssh flags via GetConnectionHelperWithSSHOpts."],"exampleFix":"# before\nexport DOCKER_HOST='ssh://user@host?ConnectTimeout=10'\n# after — option lives in ~/.ssh/config\n# Host host\n#   ConnectTimeout 10\nexport DOCKER_HOST='ssh://user@host'","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(daemonURL)\nif u != nil && u.RawQuery != \"\" {\n    return errors.New(\"ssh URL must not contain query parameters; use ~/.ssh/config\")\n}","typeGuard":null,"tryCatchPattern":"spec, err := ssh.ParseURL(daemonURL)\nif err != nil {\n    return fmt.Errorf(\"ssh URL rejected: %w\", err)\n}","preventionTips":["Never put ssh options in the DOCKER_HOST URL query string.","Use ~/.ssh/config Host blocks for options like ConnectTimeout, IdentityFile.","Document the supported DOCKER_HOST grammar for your team."],"tags":["connhelper","ssh","url","query-params","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}