{"record":{"id":"5768885019ce4af6","repo":"docker/cli","slug":"failed-to-list-tls-files-for-endpoint-s-w","errorCode":null,"errorMessage":"failed to list TLS files for endpoint %s: %w","messagePattern":"failed to list TLS files for endpoint (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/tlsstore.go","lineNumber":80,"sourceCode":"\nfunc (s *tlsStore) listContextData(name string) (map[string]EndpointFiles, error) {\n\tcontextDir := s.contextDir(name)\n\tepFSs, err := os.ReadDir(contextDir)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\treturn map[string]EndpointFiles{}, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to list TLS files for context %s: %w\", name, err)\n\t}\n\tr := make(map[string]EndpointFiles)\n\tfor _, epFS := range epFSs {\n\t\tif epFS.IsDir() {\n\t\t\tfss, err := os.ReadDir(filepath.Join(contextDir, epFS.Name()))\n\t\t\tif os.IsNotExist(err) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to list TLS files for endpoint %s: %w\", epFS.Name(), err)\n\t\t\t}\n\t\t\tvar files EndpointFiles\n\t\t\tfor _, fs := range fss {\n\t\t\t\tif !fs.IsDir() {\n\t\t\t\t\tfiles = append(files, fs.Name())\n\t\t\t\t}\n\t\t\t}\n\t\t\tr[epFS.Name()] = files\n\t\t}\n\t}\n\treturn r, nil\n}\n\n// EndpointFiles is a slice of strings representing file names\ntype EndpointFiles []string\n","sourceCodeStart":62,"sourceCodeEnd":96,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/tlsstore.go#L62-L96","documentation":"Emitted by tlsStore.listContextData when iterating over a context's endpoint subdirectories and os.ReadDir on an individual endpoint dir fails with an error other than os.IsNotExist. It wraps the underlying syscall/IO error so callers know which endpoint directory under ~/.docker/contexts/<context>/tls could not be enumerated. The error propagates up through ListTLSFiles and LoadTLSData, aborting TLS-material loading for that context.","triggerScenarios":"Calling s.ListTLSFiles(name) where the context's TLS base directory exists and one endpoint subdirectory (e.g. ~/.docker/contexts/meta/<hash>/tls/<endpoint>/) is unreadable due to a permissions error, a broken symlink, an I/O error, or a race where the dir is removed mid-read. The inner os.ReadDir at tlsstore.go:75 returns a non-nil, non-NotExist error.","commonSituations":"Filesystem permission drift after running docker as root then non-root (or sudo chown of ~/.docker), a manually edited/corrupted context store, a stale symlink left by a moved home directory, SELinux/AppArmor denying reads, or a concurrent docker context rm that deletes the dir between the outer and inner ReadDir.","solutions":["Run `ls -la ~/.docker/contexts/meta/*/tls/<endpoint>/` (the path printed via the endpoint name) and chmod/chown it so the current user can read it.","If the context is corrupted, recreate it: `docker context rm <name>` then `docker context create <name> ...` with the correct TLS flags.","Remove dangling symlinks or restore the missing files, then re-run the failing command.","On SELinux systems run `restorecon -Rv ~/.docker` to fix labels."],"exampleFix":"// before: relying on a broken context store path\nctx, err := store.ListTLSFiles(\"myctx\")\n\n// after: validate the TLS dir is readable before delegating to the store\nif fi, err := os.Stat(filepath.Join(tlsRoot, contextdir)); err != nil {\n    return fmt.Errorf(\"TLS dir unreadable for %s: %w\", contextdir, err)\n} else if fi.Mode().Perm()&0o400 == 0 {\n    return fmt.Errorf(\"no read permission on TLS dir %s\", contextdir)\n}","handlingStrategy":"validation","validationCode":"// Verify each endpoint TLS dir is readable before calling ListTLSFiles\ndir := filepath.Join(tlsRoot, contextdirOf(name))\nentries, err := os.ReadDir(dir)\nif err != nil {\n    return fmt.Errorf(\"pre-check TLS dir %s: %w\", dir, err)\n}\nfor _, e := range entries {\n    if !e.IsDir() { continue }\n    ep := filepath.Join(dir, e.Name())\n    if fi, err := os.Stat(ep); err != nil {\n        return fmt.Errorf(\"endpoint TLS dir %s unreadable: %w\", ep, err)\n    } else if fi.Mode().Perm()&0o400 == 0 {\n        return fmt.Errorf(\"no read permission on %s\", ep)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep ~/.docker ownership consistent with the user running docker (avoid sudo churn).","Never hand-edit the contexts/meta TLS tree; use docker context create/update.","Avoid running concurrent context mutations against the same context."],"tags":["filesystem","tls","docker-context","permissions"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}