# Separate Docker launch errors from the application’s exit status

> A failed docker run command does not always mean the application started and crashed.

- Canonical URL: https://update.dsesecurity.com/updates/separate-docker-launch-errors-from-the-application-s-exit-status/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:12+00:00
- Modified: 2026-10-20T18:34:32+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A failed docker run command does not always mean the application started and crashed.

## Potentially affected

Review docker run's documented launch-error categories before interpreting the contained command's result.

## DSE recommendation

DSE recommends capturing the exact invocation, sanitized error output, image reference, and exit status when a launch fails.

## Article

A failed docker run command does not always mean the application started and crashed.

## Source facts

Docker documents distinct docker run exit meanings: 125 indicates a Docker-side invocation or daemon error, 126 means the specified command could not be invoked, and 127 means it could not be found. Other exit statuses reflect the command run in the container. The distinction helps locate failure before interpreting application logs.

Source: [Docker documentation — Running containers](https://docs.docker.com/engine/containers/run/).

## Applicability

Review docker run’s documented launch-error categories before interpreting the contained command’s result.

## DSE recommendation

DSE recommends capturing the exact invocation, sanitized error output, image reference, and exit status when a launch fails. Determine whether Docker accepted the request and whether the intended executable was available before investigating application initialization. Keep command-path, executable-permission, and daemon-connectivity problems separate. Do not publish credentials contained in command arguments when collecting evidence. If a wrapper script translates exit codes, record that behavior so an automation system does not misclassify a launch failure as a completed application task.

## Verification

Using a disposable image, compare a harmless valid command, a missing executable, and a deliberately invalid Docker option. Observe the status and error location for each. Confirm the operational wrapper preserves enough information to route launch failures separately from application failures. Retain the wrapper’s reported status beside Docker’s original status for each case. Ask the automation owner to demonstrate the correct alert or failed-task classification without relying on a generic error label.

## Official reference

[Docker documentation — Running containers](https://docs.docker.com/engine/containers/run/). Reviewed October 20, 2026.

## Primary reference

- Name: Docker documentation — Running containers
- Authority: docs.docker.com
- URL: https://docs.docker.com/engine/containers/run/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Docker launch errors from the application’s exit status,” DSE Security, https://update.dsesecurity.com/updates/separate-docker-launch-errors-from-the-application-s-exit-status/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.