{"record":{"id":"fc86b34b42f3aa05","repo":"docker/cli","slug":"unable-to-open-dockerfile-w","errorCode":null,"errorMessage":"unable to open Dockerfile: %w","messagePattern":"unable to open Dockerfile: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/image/build.go","lineNumber":244,"sourceCode":"\t}\n\n\tswitch contextType {\n\tcase build.ContextTypeStdin:\n\t\t// buildCtx is tar archive. if stdin was dockerfile then it is wrapped\n\t\tbuildCtx, relDockerfile, err = build.GetContextFromReader(dockerCli.In(), options.dockerfileName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to prepare context from STDIN: %w\", err)\n\t\t}\n\tcase build.ContextTypeLocal:\n\t\tcontextDir, relDockerfile, err = build.GetContextFromLocalDir(options.context, options.dockerfileName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to prepare context: %s\", err)\n\t\t}\n\t\tif strings.HasPrefix(relDockerfile, \"..\"+string(filepath.Separator)) {\n\t\t\t// Dockerfile is outside build-context; read the Dockerfile and pass it as dockerfileCtx\n\t\t\tdockerfileCtx, err = os.Open(options.dockerfileName)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"unable to open Dockerfile: %w\", err)\n\t\t\t}\n\t\t\tdefer dockerfileCtx.Close()\n\t\t}\n\tcase build.ContextTypeGit:\n\t\tvar tempDir string\n\t\ttempDir, relDockerfile, err = build.GetContextFromGitURL(options.context, options.dockerfileName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to prepare context: %w\", err)\n\t\t}\n\t\tdefer func() {\n\t\t\t_ = os.RemoveAll(tempDir)\n\t\t}()\n\t\tcontextDir = tempDir\n\tcase build.ContextTypeRemote:\n\t\tbuildCtx, relDockerfile, err = build.GetContextFromURL(progBuff, options.context, options.dockerfileName)\n\t\tif err != nil && options.quiet {\n\t\t\t_, _ = fmt.Fprintln(dockerCli.Err(), progBuff)\n\t\t}","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/image/build.go#L226-L262","documentation":"Returned by runBuild (build.go:244) when os.Open(options.dockerfileName) fails after detecting that the resolved Dockerfile lives outside the build context (relDockerfile starts with '../'). In that case the CLI must open the Dockerfile separately to inject it into the context archive. Failure means the -f path cannot be opened for reading.","triggerScenarios":"Running 'docker build -f <outside-path> <context>' where <outside-path> does not exist, is not readable, is a directory, or is blocked by permissions. The detection that triggers this code path is specifically that the Dockerfile resolved to a location above the build context directory.","commonSituations":"Pointing -f at a Dockerfile in a parent directory that has since been moved/deleted; a Dockerfile path with a typo; the Dockerfile exists but is owned by another user with no read permission; the path resolves to a directory rather than a file.","solutions":["Verify the -f path exists and is a readable file: 'test -f <path> && head <path>'.","Move the Dockerfile into the build context to avoid the outside-context code path entirely.","Fix file ownership/permissions: 'chmod u+r <path>'.","Check for typos and relative-path confusion (path is relative to cwd, not the context)."],"exampleFix":"# before (Dockerfile outside context, unreadable)\ndocker build -f ../secrets/Dockerfile .\n# after (Dockerfile inside context)\ncp ../secrets/Dockerfile ./Dockerfile && docker build .","handlingStrategy":"validation","validationCode":"// Verify a Dockerfile specified with -f is readable, especially when outside the context.\nfunc validateDockerfileFlag(f string) error {\n\tinfo, err := os.Stat(f)\n\tif err != nil { return err }\n\tif info.IsDir() { return fmt.Errorf(\"%s is a directory\", f) }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := buildCmd.Execute(); err != nil {\n\tif strings.Contains(err.Error(), \"unable to open Dockerfile\") {\n\t\t// the -f path is missing or unreadable; correct it\n\t}\n}","preventionTips":["Keep the Dockerfile inside the build context to avoid the outside-context code path.","Verify 'test -f <dockerfile>' before building with -f.","Remember -f is relative to cwd, not to the context path."],"tags":["build","dockerfile","filesystem","context"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}