paperclipai/paperclip · error

Image override "${target.imageOverride}" is not in allowlist

Error message

Image override "${target.imageOverride}" is not in allowlist

What it means

Error "Image override "${target.imageOverride}" is not in allowlist" thrown in paperclipai/paperclip.

Source

Thrown at packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts:38

}

export interface ResolveImageDefaults {
  runtimeImage: string;
}

export interface ResolveImageConfig {
  imageAllowList: string[];
  imageRegistry?: string;
}

export function resolveImage(
  target: ResolveImageInput,
  defaults: ResolveImageDefaults,
  config: ResolveImageConfig,
): string {
  if (target.imageOverride) {
    if (!config.imageAllowList.some((p) => globMatch(p, target.imageOverride!))) {
      throw new Error(`Image override "${target.imageOverride}" is not in allowlist`);
    }
    return target.imageOverride;
  }
  if (config.imageRegistry) {
    return rewriteRegistry(defaults.runtimeImage, config.imageRegistry);
  }
  return defaults.runtimeImage;
}

function rewriteRegistry(image: string, registry: string): string {
  // image is like "ghcr.io/paperclipai/agent-runtime-claude:v1"
  // we want to replace the first two path segments (host + org) with `registry`
  const cleanRegistry = registry.replace(/\/+$/, "");
  const colonIdx = image.lastIndexOf(":");
  const tag = colonIdx >= 0 ? image.slice(colonIdx) : "";
  const path = colonIdx >= 0 ? image.slice(0, colonIdx) : image;
  const segments = path.split("/");
  // Strip the host+org (first two segments), keep the image name

View on GitHub (pinned to 120ae5428f)

Solutions

1. Add the image to the allowlist or use an allowlisted image.

When it happens

Trigger: Thrown at packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts:38 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/06331e4566cd1834. Report an issue: GitHub.