{"record":{"id":"c89f40a5107a323e","repo":"docker/cli","slug":"unrecognized-config-key-k","errorCode":null,"errorMessage":"unrecognized config key: ${k}","messagePattern":"unrecognized config key: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/context/options.go","lineNumber":85,"sourceCode":"\tif !ok {\n\t\treturn false, nil\n\t}\n\tres, err := strconv.ParseBool(strVal)\n\tif err != nil {\n\t\tvar nErr *strconv.NumError\n\t\tif errors.As(err, &nErr) {\n\t\t\treturn res, fmt.Errorf(\"%s: parsing %q: %w\", name, nErr.Num, nErr.Err)\n\t\t}\n\t\treturn res, fmt.Errorf(\"%s: %w\", name, err)\n\t}\n\treturn res, nil\n}\n\nfunc validateConfig(config map[string]string, allowedKeys map[string]struct{}) error {\n\tvar errs []error\n\tfor k := range config {\n\t\tif _, ok := allowedKeys[k]; !ok {\n\t\t\terrs = append(errs, errors.New(\"unrecognized config key: \"+k))\n\t\t}\n\t}\n\treturn errors.Join(errs...)\n}\n\nfunc getDockerEndpoint(contextStore store.Reader, config map[string]string) (docker.Endpoint, error) {\n\tif err := validateConfig(config, allowedDockerConfigKeys); err != nil {\n\t\treturn docker.Endpoint{}, err\n\t}\n\tif contextName, ok := config[keyFrom]; ok {\n\t\tmetadata, err := contextStore.GetMetadata(contextName)\n\t\tif err != nil {\n\t\t\treturn docker.Endpoint{}, err\n\t\t}\n\t\tif ep, ok := metadata.Endpoints[docker.DockerEndpoint].(docker.EndpointMeta); ok {\n\t\t\treturn docker.Endpoint{EndpointMeta: ep}, nil\n\t\t}\n\t\treturn docker.Endpoint{}, fmt.Errorf(\"unable to get endpoint from context %q\", contextName)","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/context/options.go#L67-L103","documentation":"When creating/updating a context, validateConfig() rejects any \"docker.\" configuration key not present in the allowedDockerConfigKeys allow-list (from, host, ca, cert, key, skip-tls-verify). All offending keys are collected and joined via errors.Join, so a single run reports every bad key at once.","triggerScenarios":"Running `docker context create myctx --docker typo=val` where \"typo\" is not one of the six allowed keys; the offending key name is interpolated into the message.","commonSituations":"A typo'd key (e.g. \"tls\" instead of \"ca\"); outdated documentation examples using retired key names; copy-pasting from a non-Docker tool's syntax.","solutions":["Use only allowed keys: from, host, ca, cert, key, skip-tls-verify","Check `docker context create --help` for the documented set","Fix the typo in the offending key reported in the message"],"exampleFix":"// before\ndocker context create myctx --docker tls=/etc/certs/ca.pem\n// after\ndocker context create myctx --docker ca=/etc/certs/ca.pem","handlingStrategy":"validation","validationCode":"var allowedDockerConfigKeys = map[string]struct{}{\n    \"from\": {}, \"host\": {}, \"ca\": {}, \"cert\": {}, \"key\": {}, \"skip-tls-verify\": {},\n}\nfunc isValidConfigKey(k string) bool {\n    _, ok := allowedDockerConfigKeys[k]\n    return ok\n}\n// before create: for k := range config { if !isValidConfigKey(k) { return error } }","typeGuard":"func isAllowedDockerConfigKey(k string) bool {\n    switch k {\n    case \"from\", \"host\", \"ca\", \"cert\", \"key\", \"skip-tls-verify\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Restrict context docker.* keys to the documented allow-list","Validate keys in template generators before emitting `docker context create` commands","Reference `docker context create --help` as the source of truth for key names"],"tags":["context","cli","config","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}