--socketmode 0 would make the socket unusable; pick a mode l

Error message

--socketmode 0 would make the socket unusable; pick a mode like 0700

What it means

This is a validation-guard error raised by parseSocketMode when the --socketmode flag is given an explicit zero ("0" or "000"). A file mode with no permission bits denies read, write, and execute to owner, group, and others alike, so a Unix socket created with it could never be connected to — not even by its owner. The flag accepts an empty value (meaning "use the process umask") or a nonzero octal mode such as 0700, but an explicit zero is treated as a configuration mistake and rejected at command-line parsing time, before the socket is created.

Source

Thrown at config.go:96

}

// parseSocketMode parses the --socketmode flag: an octal permission mode
// such as "0700". The empty string means "not set" and leaves the socket
// file to the process umask; an explicit zero is rejected because it would
// make the socket unusable for everyone, owner included.
func parseSocketMode(s string) (os.FileMode, error) {
	if s == "" {
		return 0, nil
	}
	mode, err := strconv.ParseUint(s, 8, 32)
	if err != nil {
		return 0, fmt.Errorf("--socketmode %q is not an octal permission mode (e.g. 0700)", s)
	}
	if mode > 0o777 {
		return 0, fmt.Errorf("--socketmode %q has bits beyond permission bits (keep it within 0777)", s)
	}
	if mode == 0 {
		return 0, fmt.Errorf("--socketmode 0 would make the socket unusable; pick a mode like 0700")
	}
	return os.FileMode(mode), nil
}

// resolveAddresses builds the list of TCP addresses to listen on.
func resolveAddresses(addrlist []string, port int) []string {
	if len(addrlist) > 0 {
		addrs := make([]string, len(addrlist))
		for i, addr := range addrlist {
			addrs[i] = fmt.Sprintf("%s:%d", addr, port)
		}
		return addrs
	}
	return []string{fmt.Sprintf(":%d", port)}
}

// resolvePort determines the listening port, using defaults for HTTP (80) or HTTPS (443).
func resolvePort(portFlag int, ssl bool) int {

View on GitHub (pinned to 7a8683dc7f)

Solutions

Use --socketmode=0777 for a fully permissive socket
Use a restrictive-but-usable mode like 0700 (owner-only)

Example fix

// before
websocketd --socketmode=0000 --port=8080 ./script.sh
// after
websocketd --socketmode=0777 --port=8080 ./script.sh

Defensive patterns

Strategy: validation

Validate before calling

if (parseInt(socketMode, 8) === 0) throw new Error('socketmode 0 makes the socket unusable; use 0777 or 0700');

Try / catch

try { setSocketMode(v) } catch { console.warn('socketmode rejected, defaulting to 0700'); setSocketMode('0700'); }

Prevention

Treat 0 as 'deny everyone', never as permissive
Default to 0700 (owner-only) or 0770 (group-shared) for Unix sockets

When it happens

Trigger: Running websocketd with --socketmode=0 or --socketmode=0000.

Common situations: Operator intending 'no restrictions' by passing 0, mistaking it for permissive (0777 is permissive; 0 denies everyone).

Related errors

AI-assisted analysis of joewalnes/websocketd@7a8683dc7f (2026-09-03). Data as JSON: /api/errors/c86bc472b8edfe7d. Report an issue: GitHub.