abiosoft/colima · warning

cannot copy registry certs to vm: %w

Error message

cannot copy registry certs to vm: %w

What it means

Logged as a warning (the function returns nil regardless) when copying host Docker registry certificates (~/.docker/certs.d) into the guest fails. During VM start, colima stats the certs dir on the host, copies it to /tmp/docker-certs in the guest via downloader.CopyToGuest, then sudo-moves it into /etc/docker/certs.d and /etc/ssl/certs so private-registry TLS works inside the VM. Failure is non-fatal: only registry cert trust degrades.

Source

Thrown at environment/vm/lima/certs.go:53

		// move from temp to final destinations
		for _, dir := range dockerCertsDirsGuest {
			if err := l.RunQuiet("sudo", "mkdir", "-p", dir); err != nil {
				return err
			}
			if err := l.RunQuiet("sudo", "cp", "-R", tmpDir+"/.", dir); err != nil {
				return err
			}
		}

		// cleanup temp
		_ = l.RunQuiet("rm", "-rf", tmpDir)

		return nil
	}()

	// not a fatal error, a warning suffices.
	if err != nil {
		log.Warnln(fmt.Errorf("cannot copy registry certs to vm: %w", err))
	}
	return nil
}

View on GitHub (pinned to c3a5f9184d)

Solutions

1. Ignore it if you do not rely on private-registry TLS — it only warns and start continues.
2. If private registries then fail TLS inside the VM, retry after the VM is healthy: 'colima stop && colima start' re-runs copyCerts.
3. Check the guest side: 'colima ssh -- ls -la /etc/docker/certs.d /etc/ssl/certs' and host side 'ls -l ~/.docker/certs.d' for unreadable files; chmod a+r the cert files.
4. Remove a stale temp dir blocking the copy: 'colima ssh -- rm -rf /tmp/docker-certs', then restart colima.
5. As a fallback, add CA certs via 'colima start --dns' or mount the certs manually and update trust inside the guest.

// skip cert copy when the host certs dir is absent or unreadable
if fi, err := os.Stat(filepath.Join(docker.DockerDir(), "certs.d")); err != nil || !fi.IsDir() {
    return nil // nothing to copy; avoids the warning entirely
}

// copyCerts already returns nil and only warns — mirror that tolerance
if err := l.copyCerts(); err != nil {
    log.Warnln(fmt.Errorf("cannot copy registry certs to vm: %w", err)) // non-fatal
}

When it happens

Trigger: A previous step in copyCerts failing: l.host.Stat says certs exist but RunQuiet('rm -rf /tmp/docker-certs') or mkdir fails (VM not fully up, SSH broken); downloader.CopyToGuest failing due to network/scp transport errors; the sudo mkdir/cp steps failing because passwordless sudo is unavailable in the guest; partial/corrupt certs.d trees with unreadable file modes.

Common situations: Corporate machines with custom registry certs in ~/.docker/certs.d whose permissions are restrictive; VM boot flakiness during start; colima upgrade changing the limactl copy mechanism while stale /tmp/docker-certs remains; guest disk full.

Related errors

• error starting %s: %w
• error creating systemd unit file: %w
• error reloading systemd daemon: %w
• error restarting docker: %w
• error setting up AI model runner: %w

AI-assisted analysis of abiosoft/colima@c3a5f9184d (2026-08-15). Data as JSON: /api/errors/31c35c3f364d7d61. Report an issue: GitHub.