{"record":{"id":"82e3d34864174d10","repo":"docker/cli","slug":"tls-data-for-s-s-s-does-not-exist","errorCode":null,"errorMessage":"TLS data for %s/%s/%s does not exist","messagePattern":"TLS data for (.+?)/(.+?)/(.+?) does not exist","errorType":"exception","errorClass":"notFoundErr","httpStatus":null,"severity":"warning","filePath":"cli/command/defaultcontextstore.go","lineNumber":190,"sourceCode":"\t\t\tfor filename := range epTLSData.Files {\n\t\t\t\tfiles = append(files, filename)\n\t\t\t}\n\t\t\ttlsfiles[epName] = files\n\t\t}\n\t\treturn tlsfiles, nil\n\t}\n\treturn s.Store.ListTLSFiles(name)\n}\n\n// GetTLSData implements store.Store's GetTLSData\nfunc (s *ContextStoreWithDefault) GetTLSData(contextName, endpointName, fileName string) ([]byte, error) {\n\tif contextName == DefaultContextName {\n\t\tdefaultContext, err := s.Resolver()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif defaultContext.TLS.Endpoints[endpointName].Files[fileName] == nil {\n\t\t\treturn nil, notFound(fmt.Errorf(\"TLS data for %s/%s/%s does not exist\", DefaultContextName, endpointName, fileName))\n\t\t}\n\t\treturn defaultContext.TLS.Endpoints[endpointName].Files[fileName], nil\n\t}\n\treturn s.Store.GetTLSData(contextName, endpointName, fileName)\n}\n\n// GetStorageInfo implements store.Store's GetStorageInfo\nfunc (s *ContextStoreWithDefault) GetStorageInfo(contextName string) store.StorageInfo {\n\tif contextName == DefaultContextName {\n\t\treturn store.StorageInfo{MetadataPath: \"<IN MEMORY>\", TLSPath: \"<IN MEMORY>\"}\n\t}\n\treturn s.Store.GetStorageInfo(contextName)\n}\n","sourceCodeStart":172,"sourceCodeEnd":204,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/defaultcontextstore.go#L172-L204","documentation":"Returned by ContextStoreWithDefault.GetTLSData (defaultcontextstore.go:190) when GetTLSData is called for the 'default' context but the requested endpoint/fileName combination is not present in the in-memory default context's TLS data. Because the default context is resolved from env/config (not disk), its TLS material is held in memory and a miss produces a notFound error.","triggerScenarios":"Calling the store's GetTLSData('default', <endpoint>, <file>) when the default context has no TLS data for that endpoint/file. Typically invoked by tooling or plugins that enumerate TLS files; also reachable if DOCKER_CONTEXT=default or no context is set and a consumer requests a TLS artifact that was never resolved (e.g., no DOCKER_* TLS env vars set).","commonSituations":"A management tool or GUI iterating over contexts and querying TLS data for the default context that has no certificates configured; migrating a script that worked against a named context (with TLS) to the default context (without TLS); env vars DOCKER_CERT_PATH/DOCKER_TLS_VERIFY unset so no TLS data is materialized.","solutions":["If you need TLS with the default context, set DOCKER_TLS_VERIFY=1 and DOCKER_CERT_PATH to a directory containing ca.pem, cert.pem, key.pem.","If you do not need TLS, treat this as informational and skip the TLS data fetch for the default context.","Create a named context with explicit TLS material instead of relying on the in-memory default: 'docker context create --docker host=...,ca=...,cert=...,key=... tls-ctx'.","In tooling, check ListTLSFiles first and only request files that are actually listed."],"exampleFix":"# before: default context has no TLS data\ndocker context use default\n# tool calls GetTLSData('default','docker','key.pem') -> error\n# after: use a named context with explicit TLS\ndocker context create --docker host=tcp://host:2376,ca=~/certs/ca.pem,cert=~/certs/cert.pem,key=~/certs/key.pem tls-ctx\ndocker context use tls-ctx","handlingStrategy":"validation","validationCode":"// Before fetching TLS data for the default context, list what is available.\nfiles, err := store.ListTLSFiles(\"default\")\nif err != nil { return err }\nwant := \"key.pem\"\nfound := false\nfor _, ef := range files[\"docker\"] {\n\tif ef == want { found = true; break }\n}\nif !found { /* skip or set DOCKER_CERT_PATH */ }","typeGuard":null,"tryCatchPattern":"if _, err := store.GetTLSData(\"default\", ep, file); err != nil {\n\tvar nf interface{ NotFound() bool }\n\tif errors.As(err, &nf) && nf.NotFound() {\n\t\t// default context has no TLS data; proceed without it or configure DOCKER_CERT_PATH\n\t}\n}","preventionTips":["Call ListTLSFiles before GetTLSData to avoid misses.","Set DOCKER_TLS_VERIFY and DOCKER_CERT_PATH if you need TLS with the default context.","Use a named context with explicit TLS for reliable, on-disk TLS material."],"tags":["docker-context","default-context","tls","not-found"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}