{"id":"2413fd6ad9aaa05d","repo":"docker/cli","slug":"error-swarm-is-not-locked","errorCode":null,"errorMessage":"error: swarm is not locked","messagePattern":"error: swarm is not locked","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/command/swarm/unlock.go","lineNumber":55,"sourceCode":"}\n\nfunc runUnlock(ctx context.Context, dockerCLI command.Cli) error {\n\tapiClient := dockerCLI.Client()\n\n\t// First see if the node is actually part of a swarm, and if it is actually locked first.\n\t// If it's in any other state than locked, don't ask for the key.\n\tres, err := apiClient.Info(ctx, client.InfoOptions{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tswitch res.Info.Swarm.LocalNodeState {\n\tcase swarm.LocalNodeStateInactive:\n\t\treturn errors.New(\"error: this node is not part of a swarm\")\n\tcase swarm.LocalNodeStateLocked:\n\t\tbreak\n\tcase swarm.LocalNodeStatePending, swarm.LocalNodeStateActive, swarm.LocalNodeStateError:\n\t\treturn errors.New(\"error: swarm is not locked\")\n\t}\n\n\tkey, err := readKey(dockerCLI.In(), \"Enter unlock key: \")\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t_, err = apiClient.SwarmUnlock(ctx, client.SwarmUnlockOptions{\n\t\tKey: key,\n\t})\n\treturn err\n}\n\nfunc readKey(in *streams.In, prompt string) (string, error) {\n\tif in.IsTerminal() {\n\t\tfmt.Print(prompt)\n\t\tdt, err := term.ReadPassword(int(in.FD()))\n\t\tfmt.Println()","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/swarm/unlock.go#L37-L73","documentation":"Returned by `docker swarm unlock` when the node is part of a swarm but its LocalNodeState is pending, active, or error rather than locked. Unlocking only makes sense when the manager's Raft store is encrypted-at-rest and currently locked (after a daemon restart with autolock enabled), so the CLI refuses to prompt for a key otherwise.","triggerScenarios":"Running `docker swarm unlock` when `Info.Swarm.LocalNodeState` is `active` (already unlocked or autolock disabled), `pending` (join in progress), or `error` — anything in the swarm but not `locked`.","commonSituations":"Running unlock twice after the first attempt succeeded; running it on a manager that was never autolocked (autolock off); scripted recovery flows that unconditionally call unlock after every daemon restart; running it on a worker node, which never locks.","solutions":["Confirm state with `docker info --format '{{.Swarm.LocalNodeState}}'` — if it's `active`, no unlock is needed.","Enable autolock first if you expected locking: `docker swarm update --autolock=true`.","In restart scripts, only call unlock when the state is actually `locked`.","If state is `error`, inspect daemon logs to recover the swarm rather than unlocking."],"exampleFix":"# before (script)\nsystemctl restart docker && docker swarm unlock < key\n# after\nsystemctl restart docker\n[ \"$(docker info --format '{{.Swarm.LocalNodeState}}')\" = locked ] && docker swarm unlock < key","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker","swarm","autolock","node-state"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}