{"record":{"id":"680e0c0f040c0ebb","repo":"docker/cli","slug":"no-unlock-key-is-set","errorCode":null,"errorMessage":"no unlock key is set","messagePattern":"no unlock key is set","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/unlock_key.go","lineNumber":79,"sourceCode":"\n\t\t\tRotateManagerUnlockKey: true,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !opts.quiet {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Successfully rotated manager unlock key.\")\n\t\t}\n\t}\n\n\tresp, err := apiClient.SwarmGetUnlockKey(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not fetch unlock key: %w\", err)\n\t}\n\n\tif resp.Key == \"\" {\n\t\treturn errors.New(\"no unlock key is set\")\n\t}\n\n\tif opts.quiet {\n\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), resp.Key)\n\t\treturn nil\n\t}\n\n\tprintUnlockCommand(dockerCLI.Out(), resp.Key)\n\treturn nil\n}\n\nfunc printUnlockCommand(out io.Writer, unlockKey string) {\n\tif len(unlockKey) > 0 {\n\t\t_, _ = fmt.Fprintf(out, \"To unlock a swarm manager after it restarts, \"+\n\t\t\t\"run the `docker swarm unlock`\\ncommand and provide the following key:\\n\\n    %s\\n\\n\"+\n\t\t\t\"Remember to store this key in a password manager, since without it you\\n\"+\n\t\t\t\"will not be able to restart the manager.\\n\", unlockKey)\n\t}","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/swarm/unlock_key.go#L61-L97","documentation":"Thrown by runUnlockKey (cli/command/swarm/unlock_key.go:79) after SwarmGetUnlockKey returns an empty Key. An empty key means autolock is not enabled, so no unlock key was ever generated and there is nothing to display.","triggerScenarios":"Running `docker swarm unlock-key` (without --rotate) on a swarm where autolock is disabled; the API returns an empty key string.","commonSituations":"Same root cause as [136] but the operator queries rather than rotates; default swarm with autolock off; checking for a key before enabling autolock.","solutions":["Enable autolock: `docker swarm update --autolock`.","Retrieve the key after enabling: `docker swarm unlock-key`.","Store the returned key in a password manager — without it managers cannot restart."],"exampleFix":"// before\ndocker swarm unlock-key   # autolock off -> no unlock key is set\n\n// after\ndocker swarm update --autolock\ndocker swarm unlock-key   # prints the key","handlingStrategy":"validation","validationCode":"res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})\nif err != nil { return err }\nif !res.Swarm.Spec.EncryptionConfig.AutoLockManagers {\n\treturn errors.New(\"autolock is off; no unlock key exists\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable autolock before querying the unlock key.","Document that an empty key response means autolock is off.","Pair enablement and key retrieval in one runbook step."],"tags":["docker","swarm","unlock-key","autolock"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}