{"record":{"id":"f517390abe57bf0d","repo":"docker/cli","slug":"invalid-bind-address-format-s","errorCode":null,"errorMessage":"invalid bind address format: %s","messagePattern":"invalid bind address format: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/hosts.go","lineNumber":75,"sourceCode":"\tproto, host, hasProto := strings.Cut(addr, \"://\")\n\tif !hasProto && proto != \"\" {\n\t\thost = proto\n\t\tproto = \"tcp\"\n\t}\n\n\tswitch proto {\n\tcase \"tcp\":\n\t\treturn ParseTCPAddr(host, defaultTCPHost)\n\tcase \"unix\":\n\t\treturn parseSimpleProtoAddr(proto, host, defaultUnixSocket)\n\tcase \"npipe\":\n\t\treturn parseSimpleProtoAddr(proto, host, defaultNamedPipe)\n\tcase \"fd\":\n\t\treturn addr, nil\n\tcase \"ssh\":\n\t\treturn addr, nil\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"invalid bind address format: %s\", addr)\n\t}\n}\n\n// parseSimpleProtoAddr parses and validates that the specified address is a valid\n// socket address for simple protocols like unix and npipe. It returns a formatted\n// socket address, either using the address parsed from addr, or the contents of\n// defaultAddr if addr is a blank string.\nfunc parseSimpleProtoAddr(proto, addr, defaultAddr string) (string, error) {\n\taddr = strings.TrimPrefix(addr, proto+\"://\")\n\tif strings.Contains(addr, \"://\") {\n\t\treturn \"\", fmt.Errorf(\"invalid proto, expected %s: %s\", proto, addr)\n\t}\n\tif addr == \"\" {\n\t\taddr = defaultAddr\n\t}\n\treturn fmt.Sprintf(\"%s://%s\", proto, addr), nil\n}\n","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/opts/hosts.go#L57-L93","documentation":"parseDockerDaemonHost accepts only the schemes tcp, unix, npipe, fd, and ssh. Any other scheme (or a non-empty token before '://' that is not one of these) reaches the default branch and is rejected. A bare host:port with no scheme is treated as tcp, so this specifically fires on an unrecognized scheme.","triggerScenarios":"Passing -H with an unsupported protocol, e.g. -H foo://x, -H http://127.0.0.1:2375, or a garbage -H value that parses into an unknown scheme.","commonSituations":"Typo in the -H scheme; using http:// instead of tcp://; copy-pasting a URL with the wrong scheme; assuming a protocol the daemon does not support.","solutions":["Use one of the supported schemes: tcp://, unix://, npipe://, fd://, ssh://.","For raw host:port, omit the scheme — tcp is assumed.","For the Docker HTTP API use tcp://host:2375 (or 2376 for TLS), not http://.","Validate the scheme against the allow-list before passing the value to ParseHost."],"exampleFix":"# before\ndocker -H http://127.0.0.1:2375 ps\n\n# after\ndocker -H tcp://127.0.0.1:2375 ps","handlingStrategy":"validation","validationCode":"var hostSchemes = map[string]bool{\"tcp\": true, \"unix\": true, \"npipe\": true, \"fd\": true, \"ssh\": true}\n\nfunc validDaemonHost(s string) error {\n    if i := strings.Index(s, \"://\"); i >= 0 {\n        if !hostSchemes[s[:i]] {\n            return fmt.Errorf(\"unsupported scheme in %q\", s)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only tcp, unix, npipe, fd, or ssh schemes for -H.","Use tcp:// for the HTTP API, not http://.","Validate the scheme at the input boundary."],"tags":["docker","daemon","host","parsing","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}