{"record":{"id":"e0a90c641a47daf9","repo":"docker/cli","slug":"failed-to-read-tls-data-for-endpoint-s-w","errorCode":null,"errorMessage":"failed to read TLS data for endpoint %s: %w","messagePattern":"failed to read TLS data for endpoint (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/tlsstore.go","lineNumber":43,"sourceCode":"func (s *tlsStore) createOrUpdate(name, endpointName, filename string, data []byte) error {\n\tparentOfRoot := filepath.Dir(s.root)\n\tif err := os.MkdirAll(parentOfRoot, 0o755); err != nil {\n\t\treturn err\n\t}\n\tendpointDir := s.endpointDir(name, endpointName)\n\tif err := os.MkdirAll(endpointDir, 0o700); err != nil {\n\t\treturn err\n\t}\n\treturn atomicwriter.WriteFile(filepath.Join(endpointDir, filename), data, 0o600)\n}\n\nfunc (s *tlsStore) getData(name, endpointName, filename string) ([]byte, error) {\n\tdata, err := os.ReadFile(filepath.Join(s.endpointDir(name, endpointName), filename))\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\treturn nil, notFound(fmt.Errorf(\"TLS data for %s/%s/%s does not exist\", name, endpointName, filename))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to read TLS data for endpoint %s: %w\", endpointName, err)\n\t}\n\treturn data, nil\n}\n\n// remove deletes all TLS data for the given context.\nfunc (s *tlsStore) remove(name string) error {\n\tif err := os.RemoveAll(s.contextDir(name)); err != nil {\n\t\treturn fmt.Errorf(\"failed to remove TLS data: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc (s *tlsStore) removeEndpoint(name, endpointName string) error {\n\tif err := os.RemoveAll(s.endpointDir(name, endpointName)); err != nil {\n\t\treturn fmt.Errorf(\"failed to remove TLS data for endpoint %s: %w\", endpointName, err)\n\t}\n\treturn nil\n}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/tlsstore.go#L25-L61","documentation":"Returned by tlsStore.getData when reading a TLS file fails for a reason other than not-exist: the file exists but os.ReadFile errors (permission denied, I/O error, path became invalid).","triggerScenarios":"Calling GetTLSData when the TLS file exists but is unreadable: permission denied because it is owned by another user, a disk/read error, or the file was removed/replaced between listing and reading.","commonSituations":"Files owned by root but CLI as a normal user; failing disk; permission reset after a backup restore; race with concurrent cleanup.","solutions":["Fix permissions on the TLS file under ~/.docker/contexts/tls/<hash>/<endpoint>/.","Re-import the TLS material if the file is damaged or replaced.","Ensure the running user can read 0600 files in that endpoint dir."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"data, err := store.GetTLSData(ctx, ep, file)\nif err != nil {\n    var perr *os.PathError\n    if errors.As(err, &perr) && errors.Is(perr.Err, os.ErrPermission) {\n        // fix perms on the file/dir, or re-import TLS material\n    }\n    return err\n}","preventionTips":["Ensure the running user owns or can read the 0600 TLS files.","Don't mix root-owned and user-owned TLS files in the same context store.","Re-import TLS material if a file is suspected to be damaged."],"tags":["context","tls","filesystem","permissions"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}