paperclipai/paperclip · error

Image override " " is not in allowlist

Error message

Image override "${target.imageOverride}" is not in allowlist

What it means

Error "Image override "${target.imageOverride}" is not in allowlist" thrown in paperclipai/paperclip.

Solutions

1. Add the image to the allowlist or use an allowlisted image.

When it happens

Trigger: Thrown at packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts:38 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/06331e4566cd1834. Report an issue: GitHub.

Appendix: source

Thrown at packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts:38

}

export interface ResolveImageDefaults {
  runtimeImage: string;
}

export interface ResolveImageConfig {
  imageAllowList: string[];
  imageRegistry?: string;
}

export function resolveImage(
  target: ResolveImageInput,
  defaults: ResolveImageDefaults,
  config: ResolveImageConfig,
): string {
  if (target.imageOverride) {
    if (!config.imageAllowList.some((p) => globMatch(p, target.imageOverride!))) {
      throw new Error(`Image override "${target.imageOverride}" is not in allowlist`);
    }
    return target.imageOverride;
  }
  if (config.imageRegistry) {
    return rewriteRegistry(defaults.runtimeImage, config.imageRegistry);
  }
  return defaults.runtimeImage;
}

function rewriteRegistry(image: string, registry: string): string {
  // image is like "ghcr.io/paperclipai/agent-runtime-claude:v1"
  // we want to replace the first two path segments (host + org) with `registry`
  const cleanRegistry = registry.replace(/\/+$/, "");
  const colonIdx = image.lastIndexOf(":");
  const tag = colonIdx >= 0 ? image.slice(colonIdx) : "";
  const path = colonIdx >= 0 ? image.slice(0, colonIdx) : image;
  const segments = path.split("/");
  // Strip the host+org (first two segments), keep the image name

View on GitHub (pinned to 120ae5428f)