{"record":{"id":"5c396b8c752b97a9","repo":"docker/cli","slug":"could-not-fetch-unlock-key-w-5c396b","errorCode":null,"errorMessage":"could not fetch unlock key: %w","messagePattern":"could not fetch unlock key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/unlock_key.go","lineNumber":75,"sourceCode":"\n\t\t_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{\n\t\t\tVersion: res.Swarm.Version,\n\t\t\tSpec:    res.Swarm.Spec,\n\n\t\t\tRotateManagerUnlockKey: true,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !opts.quiet {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Successfully rotated manager unlock key.\")\n\t\t}\n\t}\n\n\tresp, err := apiClient.SwarmGetUnlockKey(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not fetch unlock key: %w\", err)\n\t}\n\n\tif resp.Key == \"\" {\n\t\treturn errors.New(\"no unlock key is set\")\n\t}\n\n\tif opts.quiet {\n\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), resp.Key)\n\t\treturn nil\n\t}\n\n\tprintUnlockCommand(dockerCLI.Out(), resp.Key)\n\treturn nil\n}\n\nfunc printUnlockCommand(out io.Writer, unlockKey string) {\n\tif len(unlockKey) > 0 {\n\t\t_, _ = fmt.Fprintf(out, \"To unlock a swarm manager after it restarts, \"+","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/swarm/unlock_key.go#L57-L93","documentation":"Emitted by 'docker swarm unlock-key' when the final SwarmGetUnlockKey RPC fails (after an optional rotation). The rotation/update path has its own earlier checks; this wraps the read call at unlock_key.go:73-75.","triggerScenarios":"Running 'docker swarm unlock-key' (or with --rotate) when the manager cannot return the key: connection error, manager down, API/version issue, or autolock disabled (though disabled yields a different 'no unlock key is set' message only after a successful fetch).","commonSituations":"Manager lost quorum; CLI context pointing at a worker not a manager; transient network blip; daemon restarting.","solutions":["Ensure the active context targets a manager: 'docker node ls'.","Retry once the manager is reachable ('docker info' shows swarm active).","Run with --debug to inspect the wrapped underlying error."],"exampleFix":"# before: unlock-key fetch against an unhealthy manager\ndocker swarm unlock-key\n\n# after: target a healthy manager then retry\ndocker context use manager-prod\ndocker node ls\ndocker swarm unlock-key","handlingStrategy":"retry","validationCode":"// Confirm manager before fetching key\nif info, err := apiClient.Info(ctx); err != nil || !info.Swarm.ControlAvailable {\n    return errors.New(\"unlock-key requires a healthy manager\")\n}","typeGuard":"func isUnlockKeyFetchErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"could not fetch unlock key:\")\n}","tryCatchPattern":"resp, err := apiClient.SwarmGetUnlockKey(ctx)\nif err != nil {\n    // backoff and retry once\n    time.Sleep(retryBackoff)\n    resp, err = apiClient.SwarmGetUnlockKey(ctx)\n}\nreturn resp, err","preventionTips":["Target a manager context before unlock-key.","Retry transient fetch failures with backoff.","Keep the key stored safely once retrieved."],"tags":["swarm","unlock-key","autolock","daemon"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}