henrygd/beszel · error

invalid container id

Error message

invalid container id

What it means

validateContainerID checks the container ID against dockerContainerIDPattern before it is interpolated into a Docker API URL. This error is thrown when the ID contains characters outside the allowed set (hex chars, length 12/64, or a name). It is a defensive guard against path traversal / endpoint injection via unsanitized container identifiers.

Source

Thrown at agent/docker.go:794

	}
	return json.Unmarshal(dm.buf.Bytes(), d)
}

// Test docker / podman sockets and return if one exists
func getDockerHost() string {
	scheme := "unix://"
	socks := []string{"/var/run/docker.sock", fmt.Sprintf("/run/user/%v/podman/podman.sock", os.Getuid())}
	for _, sock := range socks {
		if _, err := os.Stat(sock); err == nil {
			return scheme + sock
		}
	}
	return scheme + socks[0]
}

func validateContainerID(containerID string) error {
	if !dockerContainerIDPattern.MatchString(containerID) {
		return fmt.Errorf("invalid container id")
	}
	return nil
}

func buildDockerContainerEndpoint(containerID, action string, query url.Values) (string, error) {
	if err := validateContainerID(containerID); err != nil {
		return "", err
	}
	u := &url.URL{
		Scheme: "http",
		Host:   "localhost",
		Path:   fmt.Sprintf("/containers/%s/%s", url.PathEscape(containerID), action),
	}
	if len(query) > 0 {
		u.RawQuery = query.Encode()
	}
	return u.String(), nil
}

View on GitHub (pinned to b38fb7dafa)

Solutions

  1. Ensure the container ID is the full 64-hex or 12-char short ID as returned by the daemon
  2. Trim whitespace and reject empty values before calling container APIs
  3. Regenerate/refresh cached container IDs instead of reusing old ones
  4. If passing names, use only [a-zA-Z0-9][a-zA-Z0-9_.-]*

Example fix

// before
endpoint, err := buildDockerContainerEndpoint(id, "logs", nil) // id from request param
// after
id = strings.TrimSpace(id)
if !dockerContainerIDPattern.MatchString(id) {
    return fmt.Errorf("bad container id from request")
}
endpoint, err := buildDockerContainerEndpoint(id, "logs", nil)
Defensive patterns

Strategy: validation

Validate before calling

var dockerContainerIDPattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_.-]*$`)

func validContainerID(id string) bool {
    id = strings.TrimSpace(id)
    return len(id) >= 12 && dockerContainerIDPattern.MatchString(id)
}

Type guard

func isValidContainerID(s string) bool {
    return regexp.MustCompile(`^[a-f0-9]{12,64}$`).MatchString(s)
}

Try / catch

if err := validateContainerID(id); err != nil {
    http.Error(w, "invalid container id", http.StatusBadRequest)
    return
}

Prevention

When it happens

Trigger: buildDockerContainerEndpoint (or any caller passing through it) receives an empty string, a truncated/garbage ID, an ID with slashes, query characters, or whitespace — e.g. from a stale cache entry or untrusted API input.

Common situations: Frontend/API passes a user-supplied container name with invalid characters; internal cache holds an ID from a previous daemon instance; string slicing produced a malformed short ID.

Related errors

AI-assisted analysis of henrygd/beszel@b38fb7dafa (2026-08-31). Data as JSON: /api/errors/e235ac3d3de9f02a. Report an issue: GitHub.