{"record":{"id":"b1a007217b08db5d","repo":"docker/cli","slug":"unknown-role-opts-role","errorCode":null,"errorMessage":"unknown role {opts.role}","messagePattern":"unknown role (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/join_token.go","lineNumber":50,"sourceCode":"\t\t\t\"version\": \"1.24\",\n\t\t\t\"swarm\":   \"manager\",\n\t\t},\n\t\tDisableFlagsInUseLine: true,\n\t}\n\n\tflags := cmd.Flags()\n\tflags.BoolVar(&opts.rotate, flagRotate, false, \"Rotate join token\")\n\tflags.BoolVarP(&opts.quiet, flagQuiet, \"q\", false, \"Only display token\")\n\n\treturn cmd\n}\n\nfunc runJoinToken(ctx context.Context, dockerCLI command.Cli, opts joinTokenOptions) error {\n\tworker := opts.role == \"worker\"\n\tmanager := opts.role == \"manager\"\n\n\tif !worker && !manager {\n\t\treturn errors.New(\"unknown role \" + opts.role)\n\t}\n\n\tapiClient := dockerCLI.Client()\n\n\tif opts.rotate {\n\t\tres, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{\n\t\t\tVersion:            res.Swarm.Version,\n\t\t\tSpec:               res.Swarm.Spec,\n\t\t\tRotateWorkerToken:  worker,\n\t\t\tRotateManagerToken: manager,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/swarm/join_token.go#L32-L68","documentation":"Thrown by runJoinToken (cli/command/swarm/join_token.go:50) when the positional role argument is neither 'worker' nor 'manager'. These are the only two swarm node roles, and the CLI hard-codes an exact-string match against them.","triggerScenarios":"Passing any other value: `docker swarm join-token foo`, a plural like `managers`, or an empty/whitespace string from an unset variable.","commonSituations":"Typo; a script interpolates a role variable that is empty, mis-cased, or misspelled; assuming a default role.","solutions":["Use exactly 'worker' or 'manager': `docker swarm join-token worker`.","Lower-case and trim the role variable before passing it; reject anything else in your wrapper.","Add a guard: `[ \"$role\" = worker ] || [ \"$role\" = manager ] || { echo 'bad role'; exit 1; }`."],"exampleFix":"// before\ndocker swarm join-token managers\n\n// after\ndocker swarm join-token manager","handlingStrategy":"validation","validationCode":"switch role {\ncase \"worker\", \"manager\":\ndefault:\n\treturn fmt.Errorf(\"invalid role %q; use worker or manager\", role)\n}","typeGuard":"func isValidSwarmRole(role string) bool {\n\treturn role == \"worker\" || role == \"manager\"\n}","tryCatchPattern":null,"preventionTips":["Allowlist the role string at the call site.","Trim and lower-case user input before validation.","Reject empty role variables in scripts with a guard."],"tags":["docker","swarm","join-token","validation","role"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}