conflicting options: cannot specify both --mac-address and p

Error message

conflicting options: cannot specify both --mac-address and per-network MAC address

What it means

Error [97]: While blocking on ContainerWait (condition: not-running) for the job container, the daemon's error channel delivered an error. This is a wait-API transport failure — the container may still be running, but act lost the wait stream. Distinct from exit-code failures (those produce 'exit with FAILURE').

Source

Thrown at pkg/container/docker_cli.go:832

	return endpoints, nil
}

func applyContainerOptions(n *opts.NetworkAttachmentOpts, copts *containerOptions) error { //nolint:gocyclo
	// TODO should we error if _any_ advanced option is used? (i.e. forbid to combine advanced notation with the "old" flags (`--network-alias`, `--link`, `--ip`, `--ip6`)?
	if len(n.Aliases) > 0 && copts.aliases.Len() > 0 {
		return errors.New("conflicting options: cannot specify both --network-alias and per-network alias")
	}
	if len(n.Links) > 0 && copts.links.Len() > 0 {
		return errors.New("conflicting options: cannot specify both --link and per-network links")
	}
	if n.IPv4Address.IsValid() && copts.ipv4Address != nil {
		return errors.New("conflicting options: cannot specify both --ip and per-network IPv4 address")
	}
	if n.IPv6Address.IsValid() && copts.ipv6Address != nil {
		return errors.New("conflicting options: cannot specify both --ip6 and per-network IPv6 address")
	}
	if n.MacAddress != "" && copts.macAddress != "" {
		return errors.New("conflicting options: cannot specify both --mac-address and per-network MAC address")
	}
	if len(n.LinkLocalIPs) > 0 && copts.linkLocalIPs.Len() > 0 {
		return errors.New("conflicting options: cannot specify both --link-local-ip and per-network link-local IP addresses")
	}
	if copts.aliases.Len() > 0 {
		n.Aliases = make([]string, copts.aliases.Len())
		copy(n.Aliases, copts.aliases.GetSlice())
	}
	// For a user-defined network, "--link" is an endpoint option, it creates an alias. But,
	// for the default bridge it defines a legacy-link.
	if container.NetworkMode(n.Target).IsUserDefined() && copts.links.Len() > 0 {
		n.Links = make([]string, copts.links.Len())
		copy(n.Links, copts.links.GetSlice())
	}
	if copts.ipv4Address != nil {
		if ipv4, ok := netip.AddrFromSlice(copts.ipv4Address.To4()); ok {
			n.IPv4Address = ipv4
		}

View on GitHub (pinned to 4f41128141)

Solutions

Keepalive the docker connection (ssh -o ServerAliveInterval=..., or use unix socket)
Ensure no concurrent docker rm/prune runs against act containers during a job
Check dockerd logs/restarts: systemctl status docker For long jobs on flaky links, run act on the docker host itself

Example fix

# before: idle tunnel dies during wait
$ ssh -L /tmp/d.sock:/var/run/docker.sock host & act
# after
$ ssh -o ServerAliveInterval=30 -L /tmp/d.sock:/var/run/docker.sock host & act

Defensive patterns

Strategy: retry

Try / catch

if err != nil && strings.Contains(err.Error(), "failed to wait for container") {
	// transport-level failure: verify daemon, then retry wait once via ContainerInspect loop
	for i := 0; i < 5; i++ {
		c, ierr := cli.ContainerInspect(ctx, id)
		if ierr == nil && c.State.Status == "exited" { return fmt.Errorf("exit %d", c.State.ExitCode) }
		time.Sleep(2 * time.Second)
	}
}

Prevention

Use keepalives on tunneled docker sockets
Never docker rm/prune act containers mid-job
Run act on the docker host for long jobs instead of remote DOCKER_HOST

When it happens

Trigger: cr.cli.ContainerWait's Error channel firing: daemon connection dropped during a long job, daemon restarted, API incompatibility on wait endpoint, or container removed externally while being waited on.

Common situations: Long jobs over remote/tcp DOCKER_HOST where proxies close idle connections; docker daemon OOM/restart mid-job; someone runs docker rm on the act container concurrently; CI runner networking hiccups.

Related errors

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/90568c6144e7ed74. Report an issue: GitHub.