{"record":{"id":"f8faeda49fa53b28","repo":"docker/cli","slug":"bad-mode-specified-s","errorCode":null,"errorMessage":"bad mode specified: %s","messagePattern":"bad mode specified: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":1122,"sourceCode":"\t}\n\tswitch len(split) {\n\tcase 1:\n\t\tcontainerPath = split[0]\n\t\tval = path.Clean(containerPath)\n\tcase 2:\n\t\tif isValid := validator(split[1]); isValid {\n\t\t\tcontainerPath = split[0]\n\t\t\tmode = split[1]\n\t\t\tval = fmt.Sprintf(\"%s:%s\", path.Clean(containerPath), mode)\n\t\t} else {\n\t\t\tcontainerPath = split[1]\n\t\t\tval = fmt.Sprintf(\"%s:%s\", split[0], path.Clean(containerPath))\n\t\t}\n\tcase 3:\n\t\tcontainerPath = split[1]\n\t\tmode = split[2]\n\t\tif isValid := validator(split[2]); !isValid {\n\t\t\treturn val, fmt.Errorf(\"bad mode specified: %s\", mode)\n\t\t}\n\t\tval = fmt.Sprintf(\"%s:%s:%s\", split[0], containerPath, mode)\n\t}\n\n\tif !path.IsAbs(containerPath) {\n\t\treturn val, fmt.Errorf(\"%s is not an absolute path\", containerPath)\n\t}\n\treturn val, nil\n}\n\n// validateAttach validates that the specified string is a valid attach option.\nfunc validateAttach(val string) (string, error) {\n\ts := strings.ToLower(val)\n\tif slices.Contains([]string{\"stdin\", \"stdout\", \"stderr\"}, s) {\n\t\treturn s, nil\n\t}\n\treturn val, errors.New(\"valid streams are STDIN, STDOUT and STDERR\")\n}","sourceCodeStart":1104,"sourceCodeEnd":1140,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/opts.go#L1104-L1140","documentation":"Thrown by validateLinuxPath in the 3-part case when the mode (third segment) fails the validator. validDeviceMode requires each char to be r, w, or m (unique), so any other char or empty string triggers the error.","triggerScenarios":"Passing `--device /dev/x:/dev/y:rx` (x invalid), `:rw rw` (space), `:rww` (duplicate), or `:rwx` (x not allowed). Only rwm combinations are legal.","commonSituations":"Using 'x' for execute; repeating a letter; using uppercase; including spaces; misunderstanding that device mode is r/w/m not Unix file modes.","solutions":["Use only a combination of r, w, m without duplicates, e.g. rwm, rw, r","Omit the mode to default to rwm"],"exampleFix":"# before\ndocker run --device /dev/x:/dev/y:rwx ...\n# after\ndocker run --device /dev/x:/dev/y:rwm ...","handlingStrategy":"validation","validationCode":"func validDeviceMode(mode string) bool {\n    seen := map[rune]bool{}\n    for _, c := range mode {\n        if c != 'r' && c != 'w' && c != 'm' {\n            return false\n        }\n        if seen[c] {\n            return false\n        }\n        seen[c] = true\n    }\n    return len(seen) > 0\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Offer a typed enum for device modes in your wrapper API"],"tags":["docker","device","mode","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}