{"id":"65f8f58b7978c196","repo":"docker/cli","slug":"cannot-rotate-because-autolock-is-not-turned-on","errorCode":null,"errorMessage":"cannot rotate because autolock is not turned on","messagePattern":"cannot rotate because autolock is not turned on","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/unlock_key.go","lineNumber":55,"sourceCode":"\n\tflags := cmd.Flags()\n\tflags.BoolVar(&opts.rotate, flagRotate, false, \"Rotate unlock key\")\n\tflags.BoolVarP(&opts.quiet, flagQuiet, \"q\", false, \"Only display token\")\n\n\treturn cmd\n}\n\nfunc runUnlockKey(ctx context.Context, dockerCLI command.Cli, opts unlockKeyOptions) error {\n\tapiClient := dockerCLI.Client()\n\n\tif opts.rotate {\n\t\tres, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !res.Swarm.Spec.EncryptionConfig.AutoLockManagers {\n\t\t\treturn errors.New(\"cannot rotate because autolock is not turned on\")\n\t\t}\n\n\t\t_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{\n\t\t\tVersion: res.Swarm.Version,\n\t\t\tSpec:    res.Swarm.Spec,\n\n\t\t\tRotateManagerUnlockKey: true,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !opts.quiet {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Successfully rotated manager unlock key.\")\n\t\t}\n\t}\n\n\tresp, err := apiClient.SwarmGetUnlockKey(ctx)","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/swarm/unlock_key.go#L37-L73","documentation":"Returned by `docker swarm unlock-key --rotate` when SwarmInspect shows Spec.EncryptionConfig.AutoLockManagers is false. There is no unlock key to rotate unless manager autolock (encryption of Raft logs at rest) is enabled, so the CLI rejects the rotation before calling SwarmUpdate.","triggerScenarios":"Running `docker swarm unlock-key --rotate` against a swarm whose spec has AutoLockManagers=false — autolock was never enabled, or was disabled with `docker swarm update --autolock=false` at some point before the rotation attempt.","commonSituations":"Key-rotation cron jobs or compliance scripts running against clusters where autolock was turned off; assuming autolock is on by default after `docker swarm init` (it is not unless `--autolock` was passed); operating on the wrong cluster context.","solutions":["Enable autolock first: `docker swarm update --autolock=true` (this generates and prints an unlock key).","Verify the setting with `docker swarm inspect --format '{{.Spec.EncryptionConfig.AutoLockManagers}}'` or check `docker info`.","If rotation scripts run fleet-wide, gate them on the autolock setting.","To just view the current key on an autolocked swarm, run `docker swarm unlock-key` without `--rotate`."],"exampleFix":"# before\ndocker swarm unlock-key --rotate   # fails: autolock off\n# after\ndocker swarm update --autolock=true\ndocker swarm unlock-key --rotate","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker","swarm","autolock","key-rotation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}