{"record":{"id":"34a11e6ebbce9356","repo":"testcontainers/testcontainers-java","slug":"couldn-t-set-docker-cert-path-sslconfig-is-present-but-it-s","errorCode":null,"errorMessage":"Couldn't set DOCKER_CERT_PATH. `sslConfig` is present but it's not LocalDirectorySSLConfig.","messagePattern":"Couldn't set DOCKER_CERT_PATH\\. `sslConfig` is present but it's not LocalDirectorySSLConfig\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/src/main/java/org/testcontainers/containers/LocalDockerCompose.java","lineNumber":77,"sourceCode":"        // bail out early\n        if (!CommandLine.executableExists(this.composeExecutable)) {\n            throw new ContainerLaunchException(\n                \"Local Docker Compose not found. Is \" + this.composeExecutable + \" on the PATH?\"\n            );\n        }\n\n        final Map<String, String> environment = Maps.newHashMap(env);\n        environment.put(ENV_PROJECT_NAME, identifier);\n\n        TransportConfig transportConfig = DockerClientFactory.instance().getTransportConfig();\n        SSLConfig sslConfig = transportConfig.getSslConfig();\n        if (sslConfig != null) {\n            if (sslConfig instanceof LocalDirectorySSLConfig) {\n                environment.put(\"DOCKER_CERT_PATH\", ((LocalDirectorySSLConfig) sslConfig).getDockerCertPath());\n                environment.put(\"DOCKER_TLS_VERIFY\", \"true\");\n            } else {\n                logger()\n                    .warn(\n                        \"Couldn't set DOCKER_CERT_PATH. `sslConfig` is present but it's not LocalDirectorySSLConfig.\"\n                    );\n            }\n        }\n        String dockerHost = transportConfig.getDockerHost().toString();\n        environment.put(\"DOCKER_HOST\", dockerHost);\n\n        final Stream<String> absoluteDockerComposeFilePaths = composeFiles\n            .stream()\n            .map(File::getAbsolutePath)\n            .map(Objects::toString);\n\n        final String composeFileEnvVariableValue = absoluteDockerComposeFilePaths.collect(\n            Collectors.joining(File.pathSeparator + \"\")\n        );\n        logger().debug(\"Set env COMPOSE_FILE={}\", composeFileEnvVariableValue);\n\n        final File pwd = composeFiles.get(0).getAbsoluteFile().getParentFile().getAbsoluteFile();","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/core/src/main/java/org/testcontainers/containers/LocalDockerCompose.java#L59-L95","documentation":"Testcontainers logs this warning when a DockerClientConfig has an `sslConfig` set, but it is not a LocalDirectorySSLConfig. Only LocalDirectorySSLConfig (a directory on disk containing ca.pem/cert.pem/key.pem) can be translated into the DOCKER_CERT_PATH/DOCKER_TLS_VERIFY environment variables that docker-compose needs to reach a TLS-secured Docker daemon. Other SSLConfig implementations are silently ignored, so the compose container may fail to authenticate to the daemon.","triggerScenarios":"Calling LocalDockerCompose.invoke() (via DockerComposeContainer) while the underlying DockerClientConfig's sslConfig is non-null and of a type other than LocalDirectorySSLConfig (e.g. a custom SSLConfig implementation).","commonSituations":"Running against a remote TLS-enabled Docker daemon (e.g. tcp://host:2376) where the client was configured with a non-directory-based SSL config, or a custom SSLConfig subclass; the compose invocation then cannot pass the client certificates.","solutions":["Configure the Docker client with new LocalDirectorySSLConfig(\"/path/to/cert/dir\") so DOCKER_CERT_PATH and DOCKER_TLS_VERIFY can be set.","Ensure the cert directory contains ca.pem, cert.pem and key.pem and is readable by the test process.","If a custom SSLConfig is required, write the certs to disk first and wrap that directory in LocalDirectorySSLConfig, or drop TLS by using a local daemon/socket."],"exampleFix":"// before\nDefaultDockerClientConfig.builder()\n    .withDockerTlsVerify(true)\n    .withCustomSslConfig(myCustomSslConfig) // not LocalDirectorySSLConfig\n    .build();\n// after\nDefaultDockerClientConfig.createDefaultConfigBuilder()\n    .withDockerHost(\"tcp://remote:2376\")\n    .withDockerTlsVerify(true)\n    .withDockerCertPath(\"/home/user/.docker/certs\") // becomes LocalDirectorySSLConfig\n    .build();","handlingStrategy":"validation","validationCode":"if (config.getSSLConfig() != null && !(config.getSSLConfig() instanceof LocalDirectorySSLConfig)) {\n    throw new IllegalArgumentException(\"sslConfig must be LocalDirectorySSLConfig for DockerComposeContainer\");\n}","typeGuard":"if (sslConfig instanceof LocalDirectorySSLConfig) { String path = ((LocalDirectorySSLConfig) sslConfig).getDockerCertPath(); }","tryCatchPattern":null,"preventionTips":["Always configure TLS via withDockerCertPath(...) which creates LocalDirectorySSLConfig.","Never pass custom SSLConfig implementations to configs used with DockerComposeContainer.","Check test logs for this warning on first run against remote TLS daemons."],"tags":["docker-compose","tls","ssl-config","environment-variable"],"backgroundTag":"invalid-config-value","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}