{"id":"76f76b8b4d743525","repo":"docker/cli","slug":"sysctl-s-is-not-allowed","errorCode":null,"errorMessage":"sysctl '%s' is not allowed","messagePattern":"sysctl '(.+?)' is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/opts.go","lineNumber":269,"sourceCode":"// ValidateSysctl validates a sysctl and returns it.\nfunc ValidateSysctl(val string) (string, error) {\n\tvalidSysctlMap := map[string]bool{\n\t\t\"kernel.msgmax\":          true,\n\t\t\"kernel.msgmnb\":          true,\n\t\t\"kernel.msgmni\":          true,\n\t\t\"kernel.sem\":             true,\n\t\t\"kernel.shmall\":          true,\n\t\t\"kernel.shmmax\":          true,\n\t\t\"kernel.shmmni\":          true,\n\t\t\"kernel.shm_rmid_forced\": true,\n\t}\n\tvalidSysctlPrefixes := []string{\n\t\t\"net.\",\n\t\t\"fs.mqueue.\",\n\t}\n\tk, _, ok := strings.Cut(val, \"=\")\n\tif !ok || k == \"\" {\n\t\treturn \"\", fmt.Errorf(\"sysctl '%s' is not allowed\", val)\n\t}\n\tif validSysctlMap[k] {\n\t\treturn val, nil\n\t}\n\tfor _, vp := range validSysctlPrefixes {\n\t\tif strings.HasPrefix(k, vp) {\n\t\t\treturn val, nil\n\t\t}\n\t}\n\treturn \"\", fmt.Errorf(\"sysctl '%s' is not allowed\", val)\n}\n\n// FilterOpt is a flag type for validating filters\ntype FilterOpt struct {\n\tfilter client.Filters\n}\n\n// NewFilterOpt returns a new FilterOpt","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/opts/opts.go#L251-L287","documentation":"Error \"sysctl '%s' is not allowed\" thrown in docker/cli.","triggerScenarios":"Thrown at opts/opts.go:269 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}