{"id":"4357c1c18bef1f5c","repo":"docker/cli","slug":"multiple-overlapping-subnet-configuration-is-not-s","errorCode":null,"errorMessage":"multiple overlapping subnet configuration is not supported","messagePattern":"multiple overlapping subnet configuration is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/network/create.go","lineNumber":157,"sourceCode":"func createIPAMConfig(options ipamOptions) (*network.IPAM, error) {\n\tif len(options.subnets) < len(options.ipRanges) || len(options.subnets) < len(options.gateways) {\n\t\treturn nil, errors.New(\"every ip-range or gateway must have a corresponding subnet\")\n\t}\n\tiData := map[string]*network.IPAMConfig{}\n\n\t// Populate non-overlapping subnets into consolidation map\n\tfor _, s := range options.subnets {\n\t\tfor k := range iData {\n\t\t\tok1, err := subnetMatches(s, k)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tok2, err := subnetMatches(k, s)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif ok1 || ok2 {\n\t\t\t\treturn nil, errors.New(\"multiple overlapping subnet configuration is not supported\")\n\t\t\t}\n\t\t}\n\t\tsn, err := netip.ParsePrefix(s)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tiData[s] = &network.IPAMConfig{Subnet: sn, AuxAddress: map[string]netip.Addr{}}\n\t}\n\n\t// Validate and add valid ip ranges\n\tfor _, r := range options.ipRanges {\n\t\tmatch := false\n\t\tfor _, s := range options.subnets {\n\t\t\tok, err := subnetMatches(s, r.String())\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif !ok {","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/network/create.go#L139-L175","documentation":"Raised in createIPAMConfig while consolidating subnets: each new --subnet is checked against those already collected with subnetMatches in both directions, and if either contains the other the CLI aborts. Docker's IPAM cannot represent two overlapping subnets on one network.","triggerScenarios":"`docker network create` with two --subnet values where one CIDR contains or equals the other, e.g. --subnet 10.0.0.0/16 --subnet 10.0.1.0/24, or the same subnet listed twice.","commonSituations":"Merging config fragments that each add a subnet; typos in prefix length (e.g. /16 vs /24) causing accidental containment; duplicating a subnet when adding an ip-range that was meant to go inside it.","solutions":["Make the subnets disjoint CIDRs (e.g. 10.0.0.0/24 and 10.1.0.0/24) or remove the duplicate","If you wanted a sub-allocation range inside one subnet, use --ip-range with the single parent --subnet instead of a second --subnet","Create separate networks if the workloads genuinely need overlapping address spaces"],"exampleFix":"# before\ndocker network create --subnet 10.0.0.0/16 --subnet 10.0.1.0/24 mynet\n# after\ndocker network create --subnet 10.0.0.0/16 --ip-range 10.0.1.0/24 mynet","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker","network","ipam","subnet","cli-validation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}