dagger/dagger · error

cannot set both noNetwork and hostNetwork

Error message

cannot set both noNetwork and hostNetwork

What it means

An exec cannot simultaneously disable networking entirely (noNetwork) and use the host's network namespace (hostNetwork); the two options are mutually exclusive. execNetMode validates this up front and rejects the combination. Dagger maps each option to a distinct pb.NetMode.

Source

Thrown at core/container_exec.go:364

	if netMode != pb.NetMode_UNSET {
		metaSpec.NetMode = netMode
	}

	metaSpec.Env = addDefaultEnvvar(metaSpec.Env, "PATH", utilsystem.DefaultPathEnv(platform.OS))
	if includeVolatileEnv {
		metaSpec.Env = mergeEnv(metaSpec.Env, container.VolatileEnv)
	}

	if opts.Expect != ReturnSuccess {
		metaSpec.ValidExitCodes = opts.Expect.ReturnCodes()
	}

	return &metaSpec, nil
}

func execNetMode(opts ContainerExecOpts) (pb.NetMode, error) {
	if opts.NoNetwork && opts.HostNetwork {
		return pb.NetMode_UNSET, fmt.Errorf("cannot set both noNetwork and hostNetwork")
	}
	if opts.NoNetwork {
		return pb.NetMode_NONE, nil
	}
	if opts.HostNetwork {
		return pb.NetMode_HOST, nil
	}
	return pb.NetMode_UNSET, nil
}

type serviceBindingExitError struct {
	binding ServiceBinding
	err     error
	// origins are the install-span contexts of the API calls that returned the
	// bound service. Embedded in the error message as traceparents so the
	// consuming exec span links its failure back to those API calls.
	origins []trace.SpanContext
}

View on GitHub (pinned to 82ba2681db)

Solutions

1. Set only one of noNetwork or hostNetwork to true
2. If both behaviors are desired, choose the appropriate one (hostNetwork implies full network access, so it supersedes noNetwork)
3. Audit option-merging code so defaults do not leak a conflicting network flag

Example fix

// before
ContainerExecOpts{NoNetwork: true, HostNetwork: true}
// after
ContainerExecOpts{HostNetwork: true} // or NoNetwork: true, not both

if opts.NoNetwork && opts.HostNetwork { return errors.New("choose either noNetwork or hostNetwork") }

func netOptsValid(o ContainerExecOpts) bool { return !(o.NoNetwork && o.HostNetwork) }

When it happens

Trigger: Calling ctr.WithExec with exec options where both NoNetwork:true and HostNetwork:true are set, e.g. via the low-level exec opts or a custom SDK passing both flags.

Common situations: Copy-pasting exec option structs, merging default options with user options where each set a different network flag, or porting code between APIs that used separate containers for these modes.

Related errors

• no command has been set
• failed to get caller implementation-scoped module: %w
• failed to get caller implementation-scoped module digest: %w
• malformed secret config at index %d
• get current query: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/33ba03550b137051. Report an issue: GitHub.