Repository: moby/moby
File: daemon/config/config.go (Go)

Code before:
		return err
	}

	for _, h := range config.Hosts {
		if _, err := opts.ValidateHost(h); err != nil {
			return err
		}
	}

	for _, mirror := range config.ServiceOptions.Mirrors {
		if _, err := registry.ValidateMirror(mirror); err != nil {
			return err
		}
	}

	if config.CorsHeaders != "" {
		// TODO(thaJeztah): option is used to produce error when used; remove in next release
		return errors.New(`DEPRECATED: The "api-cors-header" config parameter and the dockerd "--api-cors-header" option have been removed; use a reverse proxy if you need CORS headers`)
	}

	if _, err := parseExecOptions(config.ExecOptions); err != nil {
		return err
	}

	if err := libnetwork.ValidateFirewallBackend(config.FirewallBackend); err != nil {
		return err
	}

	// validate platform-specific settings
	return validatePlatformConfig(config)
}

// parseExecOptions parses the given exec-options into a map. It returns an
// error if the exec-options are formatted incorrectly, or when options are
// used that are not supported on this platform.
//
// TODO(thaJeztah): consider making this more strict: make options case-sensitive and disallow whitespace around "=".
func parseExecOptions(execOptions []string) (map[string]string, error) {
	o := make(map[string]string)
	for _, keyValue := range execOptions {
		k, v, ok := strings.Cut(keyValue, "=")
		k = strings.ToLower(strings.TrimSpace(k))
		v = strings.TrimSpace(v)
		if !ok || k == "" || v == "" {
			return nil, fmt.Errorf("invalid exec-opt (%s): must be formatted 'opt=value'", keyValue)
		}
		if err := validatePlatformExecOpt(k, v); err != nil {
			return nil, fmt.Errorf("invalid exec-opt (%s): %w", keyValue, err)
		}
		o[k] = v
	}

Review comment (suggestion):
Given that this validation is only for Linux, we should probably put it in `validatePlatformConfig` - that also avoids having to stub-out the function.

That said; I notice that `NetworkConfig` is platform agnostic, and `FirewallBackend` therefore would be available on Windows as well, so possibly we should return an error on any value other than "empty string" if it's Windows

(but could be through a `if runtime.GOOS != "linux"` check)

Code after:
		return err
	}

	for _, h := range config.Hosts {
		if _, err := opts.ValidateHost(h); err != nil {
			return err
		}
	}

	for _, mirror := range config.ServiceOptions.Mirrors {
		if _, err := registry.ValidateMirror(mirror); err != nil {
			return err
		}
	}

	if config.CorsHeaders != "" {
		// TODO(thaJeztah): option is used to produce error when used; remove in next release
		return errors.New(`DEPRECATED: The "api-cors-header" config parameter and the dockerd "--api-cors-header" option have been removed; use a reverse proxy if you need CORS headers`)
	}

	if _, err := parseExecOptions(config.ExecOptions); err != nil {
		return err
	}

	// validate platform-specific settings
	return validatePlatformConfig(config)
}

// parseExecOptions parses the given exec-options into a map. It returns an
// error if the exec-options are formatted incorrectly, or when options are
// used that are not supported on this platform.
//
// TODO(thaJeztah): consider making this more strict: make options case-sensitive and disallow whitespace around "=".
func parseExecOptions(execOptions []string) (map[string]string, error) {
	o := make(map[string]string)
	for _, keyValue := range execOptions {
		k, v, ok := strings.Cut(keyValue, "=")
		k = strings.ToLower(strings.TrimSpace(k))
		v = strings.TrimSpace(v)
		if !ok || k == "" || v == "" {
			return nil, fmt.Errorf("invalid exec-opt (%s): must be formatted 'opt=value'", keyValue)
		}
		if err := validatePlatformExecOpt(k, v); err != nil {
			return nil, fmt.Errorf("invalid exec-opt (%s): %w", keyValue, err)
		}
		o[k] = v
	}
	return o, nil
}

// MaskCredentials masks credentials that are in an URL.