coollabsio/coolify · error · InvalidArgumentException

Invalid container name format

Error message

Invalid container name format

What it means

Thrown by the connectToContainer terminal action when selected_container fails ValidationPatterns::isValidContainerName(), which enforces the allowlist regex /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/. The name is later interpolated into docker exec commands, so this is a command-injection guard: shell metacharacters, whitespace, or an illegal first character are rejected before any SSH/Docker call. It runs after authorize('canAccessTerminal') as defense-in-depth, because Livewire request payloads (and replayed snapshots) can be tampered with client-side.

Source

Thrown at app/Livewire/Project/Shared/ExecuteContainerCommand.php:206

            return handleError($e, $this);
        } finally {
            $this->isConnecting = false;
        }
    }

    #[On('connectToContainer')]
    public function connectToContainer()
    {
        if ($this->selected_container === 'default') {
            $this->dispatch('error', 'Please select a container.');

            return;
        }
        try {
            $this->authorize('canAccessTerminal');
            // Validate container name format
            if (! ValidationPatterns::isValidContainerName($this->selected_container)) {
                throw new \InvalidArgumentException('Invalid container name format');
            }

            // Verify container exists in our allowed list
            $container = collect($this->containers)->firstWhere('container.Names', $this->selected_container);
            if (is_null($container)) {
                throw new \RuntimeException('Container not found.');
            }

            // Verify server ownership and status
            $server = data_get($container, 'server');
            if (! $server || ! $server instanceof Server) {
                throw new \RuntimeException('Invalid server configuration.');
            }

            $this->authorize('view', $server);

            if ($server->isForceDisabled()) {
                throw new \RuntimeException('Server is disabled.');

View on GitHub (pinned to 70b9acc424)

Solutions

1. Re-select a container from the dropdown so selected_container matches ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ again
2. Reload the page so the containers list and the selected_container property resynchronize
3. If calling this from custom code, pre-validate with ValidationPatterns::isValidContainerName($name) before dispatching connectToContainer
4. If it recurs with normal UI usage, inspect the outgoing Livewire request payload for tampering (check the wire update for the selected_container property)

Example fix

// before
$this->dispatch('connectToContainer', container: $request->input('name'));

// after
use App\Support\ValidationPatterns;

if (ValidationPatterns::isValidContainerName($name)) {
    $this->dispatch('connectToContainer', container: $name);
} else {
    $this->dispatch('error', 'Invalid container name format');
}

use App\Support\ValidationPatterns;

$ok = is_string($name)
    && ValidationPatterns::isValidContainerName($name); // ^[a-zA-Z0-9][a-zA-Z0-9._-]*$
if (! $ok) {
    // reject before dispatching connectToContainer / any docker exec path
}

In the Livewire action, keep the format check before any Docker/SSH call and catch \InvalidArgumentException separately from \RuntimeException, routing both through handleError($e, $this) / dispatch('error', ...). Never echo the raw submitted name back in the message.

When it happens

Trigger: Dispatching the connectToContainer event with selected_container containing $(), backticks, ;, |, &&, spaces or newlines, or a value starting with -, . or _ (e.g. '-container', '.container'). Typically a hand-crafted or replayed Livewire update request, a stale snapshot whose property no longer matches a real Docker name, or a security scanner poking at the endpoint.

Common situations: Penetration testing / automated scanners posting crafted wire updates; browser devtools editing of the component state; stale tabs from before a container rename; tooling that passes container IDs with unusual prefixes.

Related errors

• Container not found.
• Invalid Cron / Human expression
• Invalid dockerfile_target_build: contains forbidden characte
• Invalid {$fieldName}: contains forbidden characters.
• Invalid {$fieldName}: path traversal detected.

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/4f7f9b09593f020e. Report an issue: GitHub.