{"record":{"id":"2b835fd6d3a37269","repo":"docker/cli","slug":"failed-to-retrieve-tls-data-s-for-context-q","errorCode":null,"errorMessage":"failed to retrieve TLS data (%s) for context %q: %w","messagePattern":"failed to retrieve TLS data \\((.+?)\\) for context %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/tlsdata.go","lineNumber":55,"sourceCode":"\t}\n\tif data.Key != nil {\n\t\tresult.Files[keyKey] = data.Key\n\t}\n\treturn &result\n}\n\n// LoadTLSData loads TLS data from the store\nfunc LoadTLSData(s store.Reader, contextName, endpointName string) (*TLSData, error) {\n\ttlsFiles, err := s.ListTLSFiles(contextName)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to retrieve TLS files for context %q: %w\", contextName, err)\n\t}\n\tif epTLSFiles, ok := tlsFiles[endpointName]; ok {\n\t\tvar tlsData TLSData\n\t\tfor _, f := range epTLSFiles {\n\t\t\tdata, err := s.GetTLSData(contextName, endpointName, f)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to retrieve TLS data (%s) for context %q: %w\", f, contextName, err)\n\t\t\t}\n\t\t\tswitch f {\n\t\t\tcase caKey:\n\t\t\t\ttlsData.CA = data\n\t\t\tcase certKey:\n\t\t\t\ttlsData.Cert = data\n\t\t\tcase keyKey:\n\t\t\t\ttlsData.Key = data\n\t\t\tdefault:\n\t\t\t\tlogrus.Warnf(\"unknown file in context %s TLS bundle: %s\", contextName, f)\n\t\t\t}\n\t\t}\n\t\treturn &tlsData, nil\n\t}\n\treturn nil, nil\n}\n\n// TLSDataFromFiles reads files into a TLSData struct (or returns nil if all paths are empty)","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/tlsdata.go#L37-L73","documentation":"Returned by LoadTLSData in the per-file loop (tlsdata.go:54) when store.Reader.GetTLSData fails to read one specific TLS file (ca.pem, cert.pem, or key.pem) for an endpoint of a context. The message names the offending file (%s = f) and the context (%q), wrapping the underlying read error.","triggerScenarios":"An endpoint's TLS directory is listed successfully (ca/cert/key files appear) but reading one of those individual files fails — e.g. the file was deleted between the list and the read (race), the file has 0000 perms, or the disk I/O errored. The switch then never assigns it to tlsData because GetTLSData returned an error first.","commonSituations":"Concurrent docker context update/removal, a half-written file from a killed docker process, files restored from a backup with restrictive permissions, or antivirus/audit tooling locking the key file.","solutions":["Re-run `docker context update <name> --docker-tls-verify ... --docker-cert-path ...` to rewrite the cert bundle atomically.","Inspect permissions on ca.pem/cert.pem/key.pem under the context's endpoint dir and restore 0600 readable-by-user perms.","If files are genuinely missing, recreate the context with the correct --docker-cert-path / --tls* flags.","Avoid running multiple docker-context-mutating commands in parallel against the same context."],"exampleFix":"// before: assumes all listed TLS files are still readable\ntls, err := context.LoadTLSData(s, name, endpoint)\n\n// after: surface the missing file name explicitly and offer to refresh\nif err != nil {\n    if _, statErr := os.Stat(filepath.Join(dir, \"key.pem\")); statErr != nil {\n        log.Warnf(\"TLS file vanished for %s; suggest `docker context update`\", endpoint)\n    }\n    return err\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Per-file read failures are best handled by catching and refreshing the bundle\ntls, err := context.LoadTLSData(s, contextName, endpointName)\nif err != nil {\n    log.Warnf(\"TLS load failed (%v); refreshing context %s\", err, contextName)\n    // trigger a context update that rewrites ca/cert/key atomically\n    _ = refreshContext(contextName)\n    tls, err = context.LoadTLSData(s, contextName, endpointName)\n}\nif err != nil { return err }","preventionTips":["Don't run docker context rm/update concurrently with operations that read TLS.","Use docker context update (atomicwriter.WriteFile) rather than editing key files directly.","Restore restrictive but user-readable 0600 perms after any file copy."],"tags":["filesystem","tls","docker-context","race-condition"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}