{"id":"450df49d56cac3d8","repo":"docker/cli","slug":"unrecognized-config-key","errorCode":null,"errorMessage":"unrecognized config key: ","messagePattern":"unrecognized config key: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/context/options.go","lineNumber":85,"sourceCode":"\tif !ok {\n\t\treturn false, nil\n\t}\n\tres, err := strconv.ParseBool(strVal)\n\tif err != nil {\n\t\tvar nErr *strconv.NumError\n\t\tif errors.As(err, &nErr) {\n\t\t\treturn res, fmt.Errorf(\"%s: parsing %q: %w\", name, nErr.Num, nErr.Err)\n\t\t}\n\t\treturn res, fmt.Errorf(\"%s: %w\", name, err)\n\t}\n\treturn res, nil\n}\n\nfunc validateConfig(config map[string]string, allowedKeys map[string]struct{}) error {\n\tvar errs []error\n\tfor k := range config {\n\t\tif _, ok := allowedKeys[k]; !ok {\n\t\t\terrs = append(errs, errors.New(\"unrecognized config key: \"+k))\n\t\t}\n\t}\n\treturn errors.Join(errs...)\n}\n\nfunc getDockerEndpoint(contextStore store.Reader, config map[string]string) (docker.Endpoint, error) {\n\tif err := validateConfig(config, allowedDockerConfigKeys); err != nil {\n\t\treturn docker.Endpoint{}, err\n\t}\n\tif contextName, ok := config[keyFrom]; ok {\n\t\tmetadata, err := contextStore.GetMetadata(contextName)\n\t\tif err != nil {\n\t\t\treturn docker.Endpoint{}, err\n\t\t}\n\t\tif ep, ok := metadata.Endpoints[docker.DockerEndpoint].(docker.EndpointMeta); ok {\n\t\t\treturn docker.Endpoint{EndpointMeta: ep}, nil\n\t\t}\n\t\treturn docker.Endpoint{}, fmt.Errorf(\"unable to get endpoint from context %q\", contextName)","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/context/options.go#L67-L103","documentation":"Context endpoint specs passed via --docker (and --kubernetes historically) are comma-separated key=value maps. validateConfig checks every provided key against an allowlist (for docker: host, ca, cert, key, skip-tls-verify, from) and joins an 'unrecognized config key: <k>' error for each unknown key. This catches typos and unsupported options before a broken context is persisted.","triggerScenarios":"`docker context create`/`update` with a --docker spec containing a key outside the allowlist, e.g. `--docker \"hosts=tcp://...\"`, `--docker \"tls=true\"`, or quoting mistakes that make the whole string one key (`--docker host tcp://...`). Each bad key produces one error entry via cli/command/context/options.go:85.","commonSituations":"Typos like hosts/hostname instead of host, tlsverify/tls instead of skip-tls-verify; confusing daemon.json or DOCKER_HOST option names with context config keys; unquoted specs where the shell splits on spaces or = producing garbage keys.","solutions":["Fix the key name — valid docker endpoint keys are: host, ca, cert, key, skip-tls-verify, from.","Quote the whole spec so commas/equals survive the shell: `--docker \"host=tcp://1.2.3.4:2376,skip-tls-verify=true\"`.","For TLS material use ca=/cert=/key= file paths, not daemon-style tlscacert/tlscert flags."],"exampleFix":"# before\ndocker context create remote --docker \"hosts=tcp://1.2.3.4:2376,tls=true\"\n# after\ndocker context create remote --docker \"host=tcp://1.2.3.4:2376,skip-tls-verify=true\"","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","context","configuration","validation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}