{"record":{"id":"2a0faaa4052fa81c","repo":"docker/cli","slug":"unable-to-create-docker-endpoint-config-w-2a0faa","errorCode":null,"errorMessage":"unable to create docker endpoint config: %w","messagePattern":"unable to create docker endpoint config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/context/update.go","lineNumber":78,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tdockerContext, err := command.GetDockerContext(c)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif opts.description != \"\" {\n\t\tdockerContext.Description = opts.description\n\t}\n\n\tc.Metadata = dockerContext\n\n\ttlsDataToReset := make(map[string]*store.EndpointTLSData)\n\n\tif opts.endpoint != nil {\n\t\tdockerEP, dockerTLS, err := getDockerEndpointMetadataAndTLS(s, opts.endpoint)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to create docker endpoint config: %w\", err)\n\t\t}\n\t\tc.Endpoints[docker.DockerEndpoint] = dockerEP\n\t\ttlsDataToReset[docker.DockerEndpoint] = dockerTLS\n\t}\n\tif err := validateEndpoints(c); err != nil {\n\t\treturn err\n\t}\n\tif err := s.CreateOrUpdate(c); err != nil {\n\t\treturn err\n\t}\n\tfor ep, tlsData := range tlsDataToReset {\n\t\tif err := s.ResetEndpointTLSMaterial(name, ep, tlsData); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t_, _ = fmt.Fprintln(dockerCLI.Out(), name)\n\t_, _ = fmt.Fprintf(dockerCLI.Err(), \"Successfully updated context %q\\n\", name)","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/context/update.go#L60-L96","documentation":"Returned by runUpdate (update.go:78) when getDockerEndpointMetadataAndTLS fails during 'docker context update --docker ...'. This wraps any error from getDockerEndpoint (config key validation, 'from=' resolution, ClientOpts, or client.New), so the underlying cause is in the wrapped %w. It specifically signals that the new Docker endpoint configuration supplied to 'update' could not be built.","triggerScenarios":"Running 'docker context update <name> --docker host=...' with an invalid host, an unknown config key, an invalid skip-tls-verify value, a broken 'from=' source, or invalid TLS material. Any of the getDockerEndpoint failure paths (errors 320-322) surface here when triggered via the update command.","commonSituations":"Updating a context to point at a new daemon but mistyping the host scheme; changing TLS settings and supplying a path that does not exist; adding an unrecognized --docker key (e.g., 'tls=true' instead of skip-tls-verify).","solutions":["Read the wrapped error in the output - it carries the specific cause (host, key, TLS, from=).","Validate each --docker key=value against the allowed set: from, host, ca, cert, key, skip-tls-verify.","Test the new endpoint by creating a throwaway context first: 'docker context create --docker ... test' then 'docker context update'.","Ensure any referenced TLS files exist and are readable before running update."],"exampleFix":"# before\ndocker context update my-ctx --docker host=daemon:2376,tls=true\n# after\ndocker context update my-ctx --docker host=tcp://daemon:2376,skip-tls-verify=true","handlingStrategy":"try-catch","validationCode":"// Pre-validate the --docker key/value map the way getDockerEndpoint does.\nfunc validateDockerConfig(config map[string]string) error {\n\tallowed := map[string]struct{}{\"from\":{},\"host\":{},\"ca\":{},\"cert\":{},\"key\":{},\"skip-tls-verify\":{}}\n\tfor k := range config {\n\t\tif _, ok := allowed[k]; !ok { return fmt.Errorf(\"unrecognized key: %s\", k) }\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := cli.ContextUpdate(...); err != nil {\n\tif strings.Contains(err.Error(), \"unable to create docker endpoint config\") {\n\t\t// the wrapped error has the real cause; surface it to the user for correction\n\t}\n}","preventionTips":["Test new endpoint settings with 'docker context create' before 'update'.","Restrict --docker keys to the allowed set: from, host, ca, cert, key, skip-tls-verify.","Inspect the wrapped error for the specific sub-cause (host, TLS, from)."],"tags":["docker-context","update","endpoint","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}