{"id":"35345089aaf2c661","repo":"docker/cli","slug":"cgroupns-invalid-cgroup-mode","errorCode":null,"errorMessage":"--cgroupns: invalid CGROUP mode","messagePattern":"--cgroupns: invalid CGROUP mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":535,"sourceCode":"\n\tpidMode := container.PidMode(copts.pidMode)\n\tif !pidMode.Valid() {\n\t\treturn nil, errors.New(\"--pid: invalid PID mode\")\n\t}\n\n\tutsMode := container.UTSMode(copts.utsMode)\n\tif !utsMode.Valid() {\n\t\treturn nil, errors.New(\"--uts: invalid UTS mode\")\n\t}\n\n\tusernsMode := container.UsernsMode(copts.usernsMode)\n\tif !usernsMode.Valid() {\n\t\treturn nil, errors.New(\"--userns: invalid USER mode\")\n\t}\n\n\tcgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)\n\tif !cgroupnsMode.Valid() {\n\t\treturn nil, errors.New(\"--cgroupns: invalid CGROUP mode\")\n\t}\n\n\trestartPolicy, err := opts.ParseRestartPolicy(copts.restartPolicy)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tloggingOpts, err := parseLoggingOpts(copts.loggingDriver, copts.loggingOpts.GetSlice())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsecurityOpts, err := parseSecurityOpts(copts.securityOpt.GetSlice())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsecurityOpts, maskedPaths, readonlyPaths := parseSystemPaths(securityOpts)","sourceCodeStart":517,"sourceCodeEnd":553,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/container/opts.go#L517-L553","documentation":"The CLI converts the --cgroupns flag to container.CgroupnsMode and rejects the command if Valid() fails (cli/command/container/opts.go:533-536). Valid cgroup-namespace modes are only empty, `host`, and `private`; validation happens client-side before the create request is sent.","triggerScenarios":"`docker run --cgroupns=<value>` or `docker create --cgroupns=<value>` with any value other than `host`, `private`, or empty — e.g. `--cgroupns=none`, `--cgroupns=container:<id>`, or a typo like `--cgroupns=privte`.","commonSituations":"Assuming --cgroupns supports container: syntax like --pid/--network do (it does not); scripts written for Podman which accepts additional values; typos in compose-generated or templated run commands.","solutions":["Use `--cgroupns=private` or `--cgroupns=host` — these are the only accepted values","Omit the flag to use the daemon default (private on cgroup v2, host on cgroup v1)","Fix any typo or variable expansion producing an unexpected value"],"exampleFix":"# before\ndocker run --cgroupns=none alpine\n# after\ndocker run --cgroupns=private alpine","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","cgroup-namespace","flag-validation","container-create"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}