What causes "--cgroupns: invalid CGROUP mode" in nektos/act?

Inspect the image env: docker image inspect --format '{{.Config.Env}}' and look for odd entries

--cgroupns: invalid CGROUP mode

Error message

--cgroupns: invalid CGROUP mode

What it means

Error [84]: godotenv.Unmarshal failed while parsing the Docker image's ENV entries (joined with newlines) into a map. This means the image's ENV contains a line godotenv cannot parse — malformed KEY=VALUE pairs or values with characters that break the dotenv grammar. Rare; it indicates a broken image definition rather than act misuse.

Source

Thrown at pkg/container/docker_cli.go:542

	pidMode := container.PidMode(copts.pidMode)
	if !pidMode.Valid() {
		return nil, errors.New("--pid: invalid PID mode")
	}

	utsMode := container.UTSMode(copts.utsMode)
	if !utsMode.Valid() {
		return nil, errors.New("--uts: invalid UTS mode")
	}

	usernsMode := container.UsernsMode(copts.usernsMode)
	if !usernsMode.Valid() {
		return nil, errors.New("--userns: invalid USER mode")
	}

	cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)
	if !cgroupnsMode.Valid() {
		return nil, errors.New("--cgroupns: invalid CGROUP mode")
	}

	restartPolicy, err := opts.ParseRestartPolicy(copts.restartPolicy)
	if err != nil {
		return nil, err
	}

	loggingOpts, err := parseLoggingOpts(copts.loggingDriver, copts.loggingOpts.GetSlice())
	if err != nil {
		return nil, err
	}

	securityOpts, err := parseSecurityOpts(copts.securityOpt.GetSlice())
	if err != nil {
		return nil, err
	}

	securityOpts, maskedPaths, readonlyPaths := parseSystemPaths(securityOpts)

View on GitHub (pinned to 4f41128141)

Solutions

Inspect the image env: docker image inspect <image> --format '{{.Config.Env}}' and look for odd entries
Rebuild the offending base image with clean ENV KEY=VALUE lines
Use a different/upstream base image tag
Report upstream to act if a well-formed image triggers it — the parser may need relaxing

Example fix

# before (Dockerfile)
ENV MYVAR="line1
line2"
# after
ENV MYVAR="line1 line2"

Defensive patterns

Strategy: try-catch

Validate before calling

// Validate the image env parses before use
env := inspectResult.Config.Env
if _, err := godotenv.Unmarshal(strings.Join(env, "\n")); err != nil {
	log.Warn("image ENV unparseable, skipping merge")
}

Try / catch

if err != nil && strings.Contains(err.Error(), "unmarshal image env") { /* switch base image, continue */ }

Prevention

Keep Dockerfile ENV lines simple KEY=VALUE
Test custom base images with 'docker image inspect --format {{.Config.Env}}'
Avoid newlines/odd quoting in ENV values

When it happens

Trigger: An image whose docker history ENV entries contain unparseable content: e.g. ENV lines with embedded newlines/quotes that don't round-trip, or images built by tools that emit non-datum ENV entries. The join with '\n' concatenates Config.Env, so any entry not matching KEY=VALUE(footer) syntax fails.

Common situations: Custom base images built with unusual ENV quoting; images mutated or hand-crafted; older godotenv versions in act being stricter/looser than expected; extremely long or binary content in ENV values.

Related errors

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/e29c82e96dd4fbb1. Report an issue: GitHub.