{"record":{"id":"83516f7ed1a4807e","repo":"docker/cli","slug":"could-not-fetch-unlock-key-w","errorCode":null,"errorMessage":"could not fetch unlock key: %w","messagePattern":"could not fetch unlock key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/command/swarm/init.go","lineNumber":129,"sourceCode":"\tif err != nil {\n\t\tif strings.Contains(err.Error(), \"could not choose an IP address to advertise\") || strings.Contains(err.Error(), \"could not find the system's IP address\") {\n\t\t\treturn fmt.Errorf(\"%w - specify one with --advertise-addr\", err)\n\t\t}\n\t\treturn err\n\t}\n\n\t_, _ = fmt.Fprintf(dockerCLI.Out(), \"Swarm initialized: current node (%s) is now a manager.\\n\\n\", res.NodeID)\n\n\tif err := printJoinCommand(ctx, dockerCLI, res.NodeID, true, false); err != nil {\n\t\treturn err\n\t}\n\n\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.\")\n\n\tif opts.swarmOptions.autolock {\n\t\tresp, err := apiClient.SwarmGetUnlockKey(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not fetch unlock key: %w\", err)\n\t\t}\n\t\tprintUnlockCommand(dockerCLI.Out(), resp.Key)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":111,"sourceCodeEnd":136,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/swarm/init.go#L111-L136","documentation":"After a successful 'docker swarm init --autolock', the CLI calls SwarmGetUnlockKey to print the unlock command; any error from that call is wrapped here. The swarm was initialized but the unlock key could not be retrieved for display.","triggerScenarios":"'docker swarm init --autolock' where the subsequent SwarmGetUnlockKey RPC fails (transient daemon error, connection reset, manager not yet ready to serve the key).","commonSituations":"Autolock enabled on a freshly-initialized single-manager swarm that hasn't fully converged; daemon restart between init and key fetch; API version mismatch where unlock key endpoint is unavailable.","solutions":["Recover the key later with 'docker swarm unlock-key' once the manager is stable.","Confirm the daemon/API version supports autolock and unlock keys (API >= 1.24, manager node).","Check 'docker info' for swarm status and re-run unlock-key if needed."],"exampleFix":"# before: init with autolock failed to print the key\ndocker swarm init --autolock\n\n# after: fetch the key explicitly afterwards\ndocker swarm init --autolock\ndocker swarm unlock-key","handlingStrategy":"retry","validationCode":null,"typeGuard":"func isUnlockKeyFetchErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"could not fetch unlock key:\")\n}","tryCatchPattern":"resp, err := apiClient.SwarmGetUnlockKey(ctx)\nif err != nil {\n    // swarm initialized; recover key later\n    log.Warnf(\"could not fetch unlock key after init: %v; run 'docker swarm unlock-key'\", err)\n}","preventionTips":["After init --autolock, immediately run 'docker swarm unlock-key'.","Persist the unlock key in a secrets store.","Don't treat the missing print as init failure; the swarm exists."],"tags":["swarm","init","autolock","unlock-key"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}