fix(docker): correctly validate container network mode

The previous implementation of `IsContainerNetworkMode` considered `container:` an
empty but valid container network mode. However, Docker rejects
"container:" without a name with "invalid container format container:".

This commit updates the `IsContainerNetworkMode` function to ensure that
there is at least one character for the container name after "container:",
aligning the validation with Docker's behavior.

Author: engels74

config/config_docker.go

@@ -47,7 +47,9 @@ type DockerNetworkConfiguration struct {
 // When using "container:<name>" mode, the container inherits the target container's network stack,
 // including hostname, DNS, and network interfaces.
 func (c DockerNetworkConfiguration) IsContainerNetworkMode() bool {
-	return strings.HasPrefix(c.Mode, "container:")
+	// Must have "container:" prefix and at least one character for the container name.
+	// Docker rejects "container:" without a name with "invalid container format container:".
+	return strings.HasPrefix(c.Mode, "container:") && len(c.Mode) > len("container:")
 }
 
 // DockerConfiguration defines the docker configuration used by the daemon when

config/config_docker_test.go

@@ -13,7 +13,7 @@ func TestDockerNetworkConfiguration_IsContainerNetworkMode(t *testing.T) {
 	}{
 		{"container mode with name", "container:caddy", true},
 		{"container mode with different name", "container:some-vpn-container", true},
-		{"container mode empty name", "container:", true}, // Edge case: technically valid prefix
+		{"container mode empty name", "container:", false}, // Docker rejects "container:" without a name
 		{"default pelican network", "pelican_nw", false},
 		{"bridge network", "bridge", false},
 		{"host network", "host", false},