{"id":"d14dcf7a64a9e6c6","repo":"docker/cli","slug":"valid-streams-are-stdin-stdout-and-stderr","errorCode":null,"errorMessage":"valid streams are STDIN, STDOUT and STDERR","messagePattern":"valid streams are STDIN, STDOUT and STDERR","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":1139,"sourceCode":"\t\tif isValid := validator(split[2]); !isValid {\n\t\t\treturn val, fmt.Errorf(\"bad mode specified: %s\", mode)\n\t\t}\n\t\tval = fmt.Sprintf(\"%s:%s:%s\", split[0], containerPath, mode)\n\t}\n\n\tif !path.IsAbs(containerPath) {\n\t\treturn val, fmt.Errorf(\"%s is not an absolute path\", containerPath)\n\t}\n\treturn val, nil\n}\n\n// validateAttach validates that the specified string is a valid attach option.\nfunc validateAttach(val string) (string, error) {\n\ts := strings.ToLower(val)\n\tif slices.Contains([]string{\"stdin\", \"stdout\", \"stderr\"}, s) {\n\t\treturn s, nil\n\t}\n\treturn val, errors.New(\"valid streams are STDIN, STDOUT and STDERR\")\n}\n\nfunc toNetipAddrSlice(ips []string) []netip.Addr {\n\tif len(ips) == 0 {\n\t\treturn nil\n\t}\n\tnetIPs := make([]netip.Addr, 0, len(ips))\n\tfor _, ip := range ips {\n\t\taddr, err := netip.ParseAddr(ip)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tnetIPs = append(netIPs, addr)\n\t}\n\treturn netIPs\n}\n","sourceCodeStart":1121,"sourceCodeEnd":1156,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/container/opts.go#L1121-L1156","documentation":"Returned by validateAttach in cli/command/container/opts.go, which validates each value passed to the --attach/-a flag of `docker run`/`docker create`. The flag only accepts the three standard process streams (case-insensitively normalized to lowercase); any other value is rejected so the CLI never sends a malformed attach configuration to the daemon.","triggerScenarios":"Running `docker run -a <value>` or `docker create --attach <value>` where <value> is anything other than stdin, stdout, or stderr (any case), e.g. `docker run -a all ...`, `-a std`, `-a 1`, or `-a stdout,stderr` passed as one comma-joined value since the flag expects one stream per occurrence.","commonSituations":"Trying `-a all` or `-a both` expecting a shorthand; passing comma-separated streams to a single -a flag instead of repeating the flag; scripts that interpolate an empty or misspelled variable into -a; confusing --attach (streams) with `docker start -a` (boolean).","solutions":["Use only stdin, stdout, or stderr as the value, repeating the flag for multiple streams: docker run -a stdout -a stderr ...","Do not comma-join streams into one -a value; each -a takes exactly one stream","If you want all streams attached, simply omit --attach (and -d): foreground runs attach stdout/stderr by default, add -i for stdin","Check shell variables expanding into the flag for typos or empty values"],"exampleFix":"# before\ndocker run -a stdout,stderr myimage\n# after\ndocker run -a stdout -a stderr myimage","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","container","flag-validation","attach"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}