{"record":{"id":"ffec89338559f8e7","repo":"coleam00/Archon","slug":"invalid-container-network-network-in-archon","errorCode":null,"errorMessage":"Invalid container.network '${network}' in .archon/config.yaml — must be 'bridge' or 'none'. Host networking is not allowed for container isolation.","messagePattern":"Invalid container\\.network '(.+?)' in \\.archon/config\\.yaml — must be 'bridge' or 'none'\\. Host networking is not allowed for container isolation\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cli/src/commands/workflow.ts","lineNumber":390,"sourceCode":" * dev-vs-binary version string. Operators pin `container.image` for reproducibility.\n */\nconst DEFAULT_RUNNER_IMAGE = 'archon-runner:latest';\n\n/**\n * Resolve the container backend config from the merged `container` config,\n * applying Phase B defaults (bridge network, 4 GiB memory, 512 pids).\n *\n * `container.*` comes from hand-parsed YAML (not Zod), so the values are\n * untrusted at runtime despite their static types — validate them here. In\n * particular `network` must be `bridge`/`none`: a stray `host` would otherwise\n * flow straight to `docker run --network host` and drop the network isolation.\n */\nexport function resolveContainerBackendConfig(\n  cfg: { image?: string; network?: string; memoryMb?: number; pidsLimit?: number } | undefined\n): ContainerBackendConfig {\n  const network = cfg?.network;\n  if (network !== undefined && network !== 'bridge' && network !== 'none') {\n    throw new Error(\n      `Invalid container.network '${network}' in .archon/config.yaml — must be ` +\n        \"'bridge' or 'none'. Host networking is not allowed for container isolation.\"\n    );\n  }\n  // Positive INTEGERS — `docker run --memory`/`--pids-limit` reject fractions,\n  // and Number.isFinite alone would let `512.5` through to a runtime docker error.\n  const memoryMb = cfg?.memoryMb;\n  if (memoryMb !== undefined && (!Number.isInteger(memoryMb) || memoryMb <= 0)) {\n    throw new Error(\n      `Invalid container.memoryMb '${String(memoryMb)}' — must be a positive integer (MiB).`\n    );\n  }\n  const pidsLimit = cfg?.pidsLimit;\n  if (pidsLimit !== undefined && (!Number.isInteger(pidsLimit) || pidsLimit <= 0)) {\n    throw new Error(\n      `Invalid container.pidsLimit '${String(pidsLimit)}' — must be a positive integer.`\n    );\n  }","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/cli/src/commands/workflow.ts#L372-L408","documentation":"resolveContainerBackendConfig() validates the optional `container.network` setting from .archon/config.yaml before constructing a ContainerBackendConfig. Only 'bridge' and 'none' are accepted because container isolation depends on it; 'host' and any other value are rejected with this error at workflow start rather than producing a later docker error.","triggerScenarios":"Calling resolveContainerBackendConfig (via cfg/containerConfig during workflow run setup) with config.yaml containing `container.network: host`, a typo like `container.network: bridged`, or any string other than 'bridge' or 'none'.","commonSituations":"User copies a docker-compose-style config with `network: host` into .archon/config.yaml; typos such as 'default' or 'bridged'; misunderstanding that host networking is deliberately disallowed for isolation safety.","solutions":["Edit .archon/config.yaml and set `container.network: bridge` (default) or `container.network: none`.","Remove the `container.network` key entirely to get the default 'bridge'.","If you intended host networking, use --no-worktree / non-container execution instead — container isolation never allows host mode."],"exampleFix":"// .archon/config.yaml (before)\ncontainer:\n  network: host\n// after\ncontainer:\n  network: bridge","handlingStrategy":"validation","validationCode":"const cfg = yaml.parse(readFileSync('.archon/config.yaml', 'utf-8'));\nconst n = cfg?.container?.network;\nif (n !== undefined && n !== 'bridge' && n !== 'none') {\n  throw new Error(`container.network must be 'bridge'|'none', got: ${n}`);\n}","typeGuard":"function isAllowedNetwork(n: unknown): n is 'bridge' | 'none' {\n  return n === 'bridge' || n === 'none';\n}","tryCatchPattern":"try {\n  await runWorkflow(name, opts);\n} catch (e) {\n  if (String((e as Error).message).includes(\"Invalid container.network\")) {\n    console.error('Fix container.network in .archon/config.yaml (bridge|none only).');\n  }\n}","preventionTips":["Only ever set container.network to 'bridge' or 'none'; never copy 'host' from docker-compose files.","Keep a minimal .archon/config.yaml and omit keys you do not need.","Lint config.yaml values against the schema before starting runs."],"tags":["configuration","validation","docker","container"],"backgroundTag":"invalid-config-value","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}