{"record":{"id":"31c35c3f364d7d61","repo":"abiosoft/colima","slug":"cannot-copy-registry-certs-to-vm-w","errorCode":null,"errorMessage":"cannot copy registry certs to vm: %w","messagePattern":"cannot copy registry certs to vm: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"environment/vm/lima/certs.go","lineNumber":53,"sourceCode":"\t\t// move from temp to final destinations\n\t\tfor _, dir := range dockerCertsDirsGuest {\n\t\t\tif err := l.RunQuiet(\"sudo\", \"mkdir\", \"-p\", dir); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif err := l.RunQuiet(\"sudo\", \"cp\", \"-R\", tmpDir+\"/.\", dir); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\n\t\t// cleanup temp\n\t\t_ = l.RunQuiet(\"rm\", \"-rf\", tmpDir)\n\n\t\treturn nil\n\t}()\n\n\t// not a fatal error, a warning suffices.\n\tif err != nil {\n\t\tlog.Warnln(fmt.Errorf(\"cannot copy registry certs to vm: %w\", err))\n\t}\n\treturn nil\n}\n","sourceCodeStart":35,"sourceCodeEnd":57,"githubUrl":"https://github.com/abiosoft/colima/blob/c3a5f9184d83a197184f897a9f07eb3c01b3bc88/environment/vm/lima/certs.go#L35-L57","documentation":"Logged as a warning (the function returns nil regardless) when copying host Docker registry certificates (~/.docker/certs.d) into the guest fails. During VM start, colima stats the certs dir on the host, copies it to /tmp/docker-certs in the guest via downloader.CopyToGuest, then sudo-moves it into /etc/docker/certs.d and /etc/ssl/certs so private-registry TLS works inside the VM. Failure is non-fatal: only registry cert trust degrades.","triggerScenarios":"A previous step in copyCerts failing: l.host.Stat says certs exist but RunQuiet('rm -rf /tmp/docker-certs') or mkdir fails (VM not fully up, SSH broken); downloader.CopyToGuest failing due to network/scp transport errors; the sudo mkdir/cp steps failing because passwordless sudo is unavailable in the guest; partial/corrupt certs.d trees with unreadable file modes.","commonSituations":"Corporate machines with custom registry certs in ~/.docker/certs.d whose permissions are restrictive; VM boot flakiness during start; colima upgrade changing the limactl copy mechanism while stale /tmp/docker-certs remains; guest disk full.","solutions":["Ignore it if you do not rely on private-registry TLS — it only warns and start continues.","If private registries then fail TLS inside the VM, retry after the VM is healthy: 'colima stop && colima start' re-runs copyCerts.","Check the guest side: 'colima ssh -- ls -la /etc/docker/certs.d /etc/ssl/certs' and host side 'ls -l ~/.docker/certs.d' for unreadable files; chmod a+r the cert files.","Remove a stale temp dir blocking the copy: 'colima ssh -- rm -rf /tmp/docker-certs', then restart colima.","As a fallback, add CA certs via 'colima start --dns' or mount the certs manually and update trust inside the guest."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// skip cert copy when the host certs dir is absent or unreadable\nif fi, err := os.Stat(filepath.Join(docker.DockerDir(), \"certs.d\")); err != nil || !fi.IsDir() {\n    return nil // nothing to copy; avoids the warning entirely\n}","typeGuard":null,"tryCatchPattern":"// copyCerts already returns nil and only warns — mirror that tolerance\nif err := l.copyCerts(); err != nil {\n    log.Warnln(fmt.Errorf(\"cannot copy registry certs to vm: %w\", err)) // non-fatal\n}","preventionTips":["Keep ~/.docker/certs.d world-readable (chmod -R a+r) so guest copies succeed.","Restart colima after fixing cert files; copyCerts runs on every VM start.","If you don't use private registries, remove certs.d to skip the code path."],"tags":["docker","registry","certificates","vm","non-fatal"],"backgroundTag":null,"analyzedSha":"c3a5f9184d83a197184f897a9f07eb3c01b3bc88","analyzedAt":"2026-08-15T18:58:08.334Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}