docker/cli · error

valid streams are STDIN, STDOUT and STDERR

Error message

valid streams are STDIN, STDOUT and STDERR

What it means

Returned by validateAttach in cli/command/container/opts.go, which validates each value passed to the --attach/-a flag of `docker run`/`docker create`. The flag only accepts the three standard process streams (case-insensitively normalized to lowercase); any other value is rejected so the CLI never sends a malformed attach configuration to the daemon.

Source

Thrown at cli/command/container/opts.go:1139

		if isValid := validator(split[2]); !isValid {
			return val, fmt.Errorf("bad mode specified: %s", mode)
		}
		val = fmt.Sprintf("%s:%s:%s", split[0], containerPath, mode)
	}

	if !path.IsAbs(containerPath) {
		return val, fmt.Errorf("%s is not an absolute path", containerPath)
	}
	return val, nil
}

// validateAttach validates that the specified string is a valid attach option.
func validateAttach(val string) (string, error) {
	s := strings.ToLower(val)
	if slices.Contains([]string{"stdin", "stdout", "stderr"}, s) {
		return s, nil
	}
	return val, errors.New("valid streams are STDIN, STDOUT and STDERR")
}

func toNetipAddrSlice(ips []string) []netip.Addr {
	if len(ips) == 0 {
		return nil
	}
	netIPs := make([]netip.Addr, 0, len(ips))
	for _, ip := range ips {
		addr, err := netip.ParseAddr(ip)
		if err != nil {
			continue
		}
		netIPs = append(netIPs, addr)
	}
	return netIPs
}

View on GitHub (pinned to e9452d6e78)

Solutions

1. Use only stdin, stdout, or stderr as the value, repeating the flag for multiple streams: docker run -a stdout -a stderr ...
2. Do not comma-join streams into one -a value; each -a takes exactly one stream
3. If you want all streams attached, simply omit --attach (and -d): foreground runs attach stdout/stderr by default, add -i for stdin
4. Check shell variables expanding into the flag for typos or empty values

Example fix

# before
docker run -a stdout,stderr myimage
# after
docker run -a stdout -a stderr myimage

When it happens

Trigger: Running `docker run -a <value>` or `docker create --attach <value>` where <value> is anything other than stdin, stdout, or stderr (any case), e.g. `docker run -a all ...`, `-a std`, `-a 1`, or `-a stdout,stderr` passed as one comma-joined value since the flag expects one stream per occurrence.

Common situations: Trying `-a all` or `-a both` expecting a shorthand; passing comma-separated streams to a single -a flag instead of repeating the flag; scripts that interpolate an empty or misspelled variable into -a; confusing --attach (streams) with `docker start -a` (boolean).

Related errors

• you cannot start and attach multiple containers at once
• cannot attach to a stopped container, start it first
• cannot attach to a paused container, unpause it first
• cannot attach to a restarting container, wait until it is ru
• --pid: invalid PID mode

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/d14dcf7a64a9e6c6.json. Report an issue: GitHub.