{"record":{"id":"77d40f87cc9c6670","repo":"docker/cli","slug":"default-context-cannot-be-edited","errorCode":null,"errorMessage":"default context cannot be edited","messagePattern":"default context cannot be edited","errorType":"validation","errorClass":"invalidParameterErr","httpStatus":null,"severity":"error","filePath":"cli/command/defaultcontextstore.go","lineNumber":149,"sourceCode":"\treturn s.Store.Remove(name)\n}\n\n// GetMetadata implements store.Store's GetMetadata\nfunc (s *ContextStoreWithDefault) GetMetadata(name string) (store.Metadata, error) {\n\tif name == DefaultContextName {\n\t\tdefaultContext, err := s.Resolver()\n\t\tif err != nil {\n\t\t\treturn store.Metadata{}, err\n\t\t}\n\t\treturn defaultContext.Meta, nil\n\t}\n\treturn s.Store.GetMetadata(name)\n}\n\n// ResetTLSMaterial is not implemented for default context and fails\nfunc (s *ContextStoreWithDefault) ResetTLSMaterial(name string, data *store.ContextTLSData) error {\n\tif name == DefaultContextName {\n\t\treturn invalidParameter(errors.New(\"default context cannot be edited\"))\n\t}\n\treturn s.Store.ResetTLSMaterial(name, data)\n}\n\n// ResetEndpointTLSMaterial is not implemented for default context and fails\nfunc (s *ContextStoreWithDefault) ResetEndpointTLSMaterial(contextName string, endpointName string, data *store.EndpointTLSData) error {\n\tif contextName == DefaultContextName {\n\t\treturn invalidParameter(errors.New(\"default context cannot be edited\"))\n\t}\n\treturn s.Store.ResetEndpointTLSMaterial(contextName, endpointName, data)\n}\n\n// ListTLSFiles implements store.Store's ListTLSFiles\nfunc (s *ContextStoreWithDefault) ListTLSFiles(name string) (map[string]store.EndpointFiles, error) {\n\tif name == DefaultContextName {\n\t\tdefaultContext, err := s.Resolver()\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/defaultcontextstore.go#L131-L167","documentation":"ContextStoreWithDefault.ResetTLSMaterial() rejects the \"default\" name. The default context's TLS material is held in memory (resolved from DOCKER_* TLS env vars and config), so bulk-resetting TLS material for it is not supported and returns invalidParameter.","triggerScenarios":"Programmatically calling ResetTLSMaterial(\"default\", data); `docker context update default` flows that try to reset TLS material.","commonSituations":"Tooling that rotates TLS certs for every context including default; automation unaware default is synthetic.","solutions":["Manage the default context's TLS via DOCKER_TLS_VERIFY / DOCKER_CERT_PATH env vars instead","Target a real stored context name for TLS reset","Exclude \"default\" from any TLS-rotation loop"],"exampleFix":"// before\nstore.ResetTLSMaterial(\"default\", &tls)\n// after\nstore.ResetTLSMaterial(\"myctx\", &tls)","handlingStrategy":"validation","validationCode":"if name == command.DefaultContextName {\n    return fmt.Errorf(\"cannot reset TLS material on the default context; set DOCKER_CERT_PATH/DOCKER_TLS_VERIFY instead\")\n}\nreturn store.ResetTLSMaterial(name, data)","typeGuard":"func isReservedContextName(name string) bool { return name == command.DefaultContextName }","tryCatchPattern":null,"preventionTips":["Manage default-context TLS through DOCKER_CERT_PATH / DOCKER_TLS_VERIFY env vars","Skip default in any TLS-rotation routine over contexts","Target named stored contexts for programmatic TLS reset"],"tags":["context","store","tls","cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}