{"record":{"id":"5da836381c27f70d","repo":"docker/cli","slug":"could-not-fetch-unlock-key-w-5da836","errorCode":null,"errorMessage":"could not fetch unlock key: %w","messagePattern":"could not fetch unlock key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/command/swarm/update.go","lineNumber":70,"sourceCode":"\n\topts.mergeSwarmSpec(&sw.Swarm.Spec, flags, &sw.Swarm.ClusterInfo.TLSInfo.TrustRoot)\n\n\tcurAutoLock := sw.Swarm.Spec.EncryptionConfig.AutoLockManagers\n\n\t_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{\n\t\tVersion: sw.Swarm.Version,\n\t\tSpec:    sw.Swarm.Spec,\n\t})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Swarm updated.\")\n\n\tif curAutoLock && !prevAutoLock {\n\t\tresp, err := apiClient.SwarmGetUnlockKey(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not fetch unlock key: %w\", err)\n\t\t}\n\t\tprintUnlockCommand(dockerCLI.Out(), resp.Key)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":52,"sourceCodeEnd":77,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/swarm/update.go#L52-L77","documentation":"Thrown by 'docker swarm update' when autolocking was just enabled (curAutoLock && !prevAutoLock) and the follow-up SwarmGetUnlockKey call fails. The update itself succeeded, but the unlock key needed to display could not be fetched.","triggerScenarios":"Running 'docker swarm update --autolock=true' on a swarm where autolock was previously off; the subsequent key fetch at update.go:67-71 errors (daemon hiccup, manager instability right after the spec change).","commonSituations":"Manager under load right after a spec update; network flakiness; the update triggered a leadership change that briefly made the key endpoint unavailable.","solutions":["Retrieve the key once stable: 'docker swarm unlock-key'.","Confirm autolock is now on via 'docker info' (look for autolock).","If managers are now locked out, use 'docker swarm unlock' with a previously saved key."],"exampleFix":"# before: update enabled autolock but key fetch failed\ndocker swarm update --autolock\n\n# after: fetch the key explicitly after the update\ndocker swarm update --autolock\ndocker swarm unlock-key","handlingStrategy":"retry","validationCode":null,"typeGuard":"func isUnlockKeyFetchErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"could not fetch unlock key:\")\n}","tryCatchPattern":"if err := runUpdate(ctx, cli, flags, opts); err != nil {\n    if isUnlockKeyFetchErr(err) {\n        // update succeeded; fetch key separately\n        _ = cli.RunDockerCmd(\"swarm\", \"unlock-key\")\n        return nil\n    }\n    return err\n}","preventionTips":["After enabling autolock via update, run 'docker swarm unlock-key'.","Persist the key immediately.","Don't treat key-fetch failure as update failure."],"tags":["swarm","update","autolock","unlock-key"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}