portainer/portainer · error · ErrContainerCapabilitiesForbidden

forbidden to use container capabilities

Error message

forbidden to use container capabilities

What it means

Error "forbidden to use container capabilities" thrown in portainer/portainer.

Source

Thrown at api/http/proxy/factory/docker/containers.go:32

	"github.com/portainer/portainer/api/docker/consts"
	"github.com/portainer/portainer/api/http/proxy/factory/utils"
	"github.com/portainer/portainer/api/http/security"
	"github.com/portainer/portainer/api/internal/authorization"
	"github.com/portainer/portainer/api/logs"

	"github.com/docker/docker/client"
	"github.com/segmentio/encoding/json"
)

const containerObjectIdentifier = "Id"

var (
	ErrPrivilegedModeForbidden        = errors.New("forbidden to use privileged mode")
	ErrPIDHostNamespaceForbidden      = errors.New("forbidden to use pid host namespace")
	ErrDeviceMappingForbidden         = errors.New("forbidden to use device mapping")
	ErrSysCtlSettingsForbidden        = errors.New("forbidden to use sysctl settings")
	ErrSecurityOptSettingsForbidden   = errors.New("forbidden to use security-opt settings")
	ErrContainerCapabilitiesForbidden = errors.New("forbidden to use container capabilities")
	ErrBindMountsForbidden            = errors.New("forbidden to use bind mounts")
)

type PartialMount struct {
	Type          string `json:"Type"`
	Source        string `json:"Source"`
	VolumeOptions *struct {
		DriverConfig *struct {
			Name    string            `json:"Name"`
			Options map[string]string `json:"Options"`
		} `json:"DriverConfig"`
	} `json:"VolumeOptions"`
}

func referencedVolumeNames(binds []string, mounts []PartialMount) []string {
	var names []string

	for _, bind := range binds {

View on GitHub (pinned to 17e74456ff)

When it happens

Trigger: Thrown at api/http/proxy/factory/docker/containers.go:32 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of portainer/portainer@17e74456ff (2026-08-26). Data as JSON: /api/errors/5271a9c2ab1629d7. Report an issue: GitHub.